Jenkins Project
Page 8 of 16 — Jenkins Project CVEs from a corpus of 1545, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34172 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site script… |
CVE-2022-34171 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons i… |
CVE-2022-34170 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is par… |
CVE-2022-30972 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e… |
CVE-2022-30971 | High | 8.8 | 2022-05-17 | Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-30970 | Medium | 5.4 | 2022-05-17 | Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner f… |
CVE-2022-30969 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without s… |
CVE-2022-30968 | Medium | 5.4 | 2022-05-17 | Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stor… |
CVE-2022-30967 | Medium | 5.4 | 2022-05-17 | Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parame… |
CVE-2022-30966 | Medium | 5.4 | 2022-05-17 | Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, res… |
CVE-2022-30965 | Medium | 5.4 | 2022-05-17 | Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters… |
CVE-2022-30964 | Medium | 5.4 | 2022-05-17 | Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulti… |
CVE-2022-30963 | Medium | 5.4 | 2022-05-17 | Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored c… |
CVE-2022-30962 | Medium | 5.4 | 2022-05-17 | Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displayi… |
CVE-2022-30961 | Medium | 5.4 | 2022-05-17 | Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying… |
CVE-2022-30960 | Medium | 5.4 | 2022-05-17 | Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resultin… |
CVE-2022-30959 | Medium | 6.5 | 2022-05-17 | A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server… |
CVE-2022-30958 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH server using… |
CVE-2022-30957 | Medium | 4.3 | 2022-05-17 | A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials st… |
CVE-2022-30956 | Medium | 5.4 | 2022-05-17 | Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulner… |
CVE-2022-30955 | Medium | 6.5 | 2022-05-17 | Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate… |
CVE-2022-30954 | Medium | 6.5 | 2022-05-17 | Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to… |
CVE-2022-30953 | Medium | 6.5 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP ser… |
CVE-2022-30952 | Medium | 6.5 | 2022-05-17 | Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified… |
CVE-2022-30951 | High | 8.8 | 2022-05-17 | Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially allowing users to… |
CVE-2022-30950 | High | 8.8 | 2022-05-17 | Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflow vulnerability that may allow users ab… |
CVE-2022-30949 | Medium | 5.3 | 2022-05-17 | Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file… |
CVE-2022-30948 | High | 7.5 | 2022-05-17 | Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's fi… |
CVE-2022-30947 | High | 7.5 | 2022-05-17 | Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file s… |
CVE-2022-30946 | Medium | 4.3 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an… |
CVE-2022-30945 | High | 8.5 | 2022-05-17 | Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sand… |
CVE-2022-29052 | Medium | 4.3 | 2022-04-12 | Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can… |
CVE-2022-29051 | Medium | 4.3 | 2022-04-12 | Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permission to connect to an FTP server using at… |
CVE-2022-29050 | High | 8.8 | 2022-04-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attack… |
CVE-2022-29049 | Medium | 5.4 | 2022-04-12 | Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers… |
CVE-2022-29048 | Medium | 4.3 | 2022-04-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-29047 | Medium | 5.3 | 2022-04-12 | Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent)… |
CVE-2022-29046 | Medium | 5.4 | 2022-04-12 | Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying paramet… |
CVE-2022-29045 | Medium | 5.4 | 2022-04-12 | Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build parameters on views di… |
CVE-2022-29044 | Medium | 5.4 | 2022-04-12 | Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters… |
CVE-2022-29043 | Medium | 5.4 | 2022-04-12 | Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, result… |
CVE-2022-29042 | Medium | 5.4 | 2022-04-12 | Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameters on Job Generator… |
CVE-2022-29041 | Medium | 5.4 | 2022-04-12 | Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displayi… |
CVE-2022-29040 | Medium | 5.4 | 2022-04-12 | Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a store… |
CVE-2022-29039 | Medium | 5.4 | 2022-04-12 | Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, r… |
CVE-2022-29038 | Medium | 5.4 | 2022-04-12 | Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameters on views display… |
CVE-2022-29037 | Medium | 5.4 | 2022-04-12 | Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a sto… |
CVE-2022-29036 | Medium | 5.4 | 2022-04-12 | Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name… |
CVE-2022-28160 | Medium | 6.5 | 2022-03-29 | Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller. |
CVE-2022-28159 | Medium | 5.4 | 2022-03-29 | Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting in a stored cross-site… |
CVE-2022-28158 | Medium | 6.5 | 2022-03-29 | A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials… |
CVE-2022-28157 | Medium | 6.5 | 2022-03-29 | Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller… |
CVE-2022-28156 | Medium | 6.5 | 2022-03-29 | Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenk… |
CVE-2022-28155 | High | 8.1 | 2022-03-29 | Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-28154 | High | 8.1 | 2022-03-29 | Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-28153 | Medium | 5.4 | 2022-03-29 | Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2022-28152 | Medium | 4.3 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore the default ownership… |
CVE-2022-28151 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change the owners and item… |
CVE-2022-28150 | High | 8.8 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to change the owners and item-sp… |
CVE-2022-28149 | Medium | 5.4 | 2022-03-29 | Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-site scripting (XSS) vu… |
CVE-2022-28148 | Medium | 6.5 | 2022-03-29 | The file browser in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier may interpret some paths to files as absolute on Windows, resulting in… |
CVE-2022-28147 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permission to check for t… |
CVE-2022-28146 | Medium | 6.5 | 2022-03-29 | Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins con… |
CVE-2022-28145 | Medium | 5.4 | 2022-03-29 | Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a s… |
CVE-2022-28144 | Medium | 6.5 | 2022-03-29 | Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to conn… |
CVE-2022-28143 | Medium | 6.5 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an attacker-specified host using a… |
CVE-2022-28142 | High | 7.5 | 2022-03-29 | Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to ignore SSL/TLS issu… |
CVE-2022-28141 | Medium | 6.5 | 2022-03-29 | Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins controller where it ca… |
CVE-2022-28140 | High | 8.1 | 2022-03-29 | Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-28139 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-spe… |
CVE-2022-28138 | Medium | 4.3 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified… |
CVE-2022-28137 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permission to connect to a… |
CVE-2022-28136 | High | 8.8 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers to connect to an atta… |
CVE-2022-28135 | Medium | 6.5 | 2022-03-29 | Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins ins… |
CVE-2022-28134 | Medium | 5.4 | 2022-03-29 | Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Rea… |
CVE-2022-28133 | Medium | 5.4 | 2022-03-29 | Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site… |
CVE-2022-27218 | Medium | 4.3 | 2022-03-15 | Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed… |
CVE-2022-27217 | Medium | 6.5 | 2022-03-15 | Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be view… |
CVE-2022-27216 | Medium | 6.5 | 2022-03-15 | Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins controller where they ca… |
CVE-2022-27215 | Medium | 4.3 | 2022-03-15 | A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2022-27214 | Medium | 4.3 | 2022-03-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL u… |
CVE-2022-27213 | Medium | 5.4 | 2022-03-15 | Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, result… |
CVE-2022-27212 | Medium | 5.4 | 2022-03-15 | Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulting in a stored cr… |
CVE-2022-27211 | Medium | 6.5 | 2022-03-15 | A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2022-27210 | Medium | 6.5 | 2022-03-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to connect to an attacker-s… |
CVE-2022-27209 | Medium | 6.5 | 2022-03-15 | A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2022-27208 | Medium | 6.5 | 2022-03-15 | Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on the Jenkins controller. |
CVE-2022-27207 | Medium | 4.8 | 2022-03-15 | Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a s… |
CVE-2022-27206 | Medium | 6.5 | 2022-03-15 | Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where… |
CVE-2022-27205 | Medium | 4.3 | 2022-03-15 | A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect… |
CVE-2022-27204 | High | 8.8 | 2022-03-15 | A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers to connect to an attacke… |
CVE-2022-27203 | Medium | 6.5 | 2022-03-15 | Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and… |
CVE-2022-27202 | Medium | 5.4 | 2022-03-15 | Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parameters of radio button… |
CVE-2022-27201 | Medium | 6.5 | 2022-03-15 | Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about t… |
CVE-2022-27200 | Medium | 4.8 | 2022-03-15 | Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulting in a stored cr… |
CVE-2022-27199 | Medium | 4.3 | 2022-03-15 | A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect t… |
CVE-2022-27198 | High | 8.0 | 2022-03-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read… |
CVE-2022-27197 | Medium | 5.4 | 2022-03-15 | Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scr… |
CVE-2022-27196 | Medium | 5.4 | 2022-03-15 | Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerabil… |
CVE-2022-27195 | Medium | 5.5 | 2022-03-15 | Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, inc… |