Jenkins Project
Page 9 of 16 — Jenkins Project CVEs from a corpus of 1583, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28146 | Medium | 6.5 | 2022-03-29 | Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins con… |
CVE-2022-28145 | Medium | 5.4 | 2022-03-29 | Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a s… |
CVE-2022-28144 | Medium | 6.5 | 2022-03-29 | Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to conn… |
CVE-2022-28143 | Medium | 6.5 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an attacker-specified host using a… |
CVE-2022-28142 | High | 7.5 | 2022-03-29 | Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to ignore SSL/TLS issu… |
CVE-2022-28141 | Medium | 6.5 | 2022-03-29 | Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins controller where it ca… |
CVE-2022-28140 | High | 8.1 | 2022-03-29 | Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-28139 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-spe… |
CVE-2022-28138 | Medium | 4.3 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified… |
CVE-2022-28137 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permission to connect to a… |
CVE-2022-28136 | High | 8.8 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers to connect to an atta… |
CVE-2022-28135 | Medium | 6.5 | 2022-03-29 | Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins ins… |
CVE-2022-28134 | Medium | 5.4 | 2022-03-29 | Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Rea… |
CVE-2022-28133 | Medium | 5.4 | 2022-03-29 | Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site… |
CVE-2022-27218 | Medium | 4.3 | 2022-03-15 | Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed… |
CVE-2022-27217 | Medium | 6.5 | 2022-03-15 | Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be view… |
CVE-2022-27216 | Medium | 6.5 | 2022-03-15 | Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins controller where they ca… |
CVE-2022-27215 | Medium | 4.3 | 2022-03-15 | A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2022-27214 | Medium | 4.3 | 2022-03-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL u… |
CVE-2022-27213 | Medium | 5.4 | 2022-03-15 | Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, result… |
CVE-2022-27212 | Medium | 5.4 | 2022-03-15 | Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulting in a stored cr… |
CVE-2022-27211 | Medium | 6.5 | 2022-03-15 | A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2022-27210 | Medium | 6.5 | 2022-03-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to connect to an attacker-s… |
CVE-2022-27209 | Medium | 6.5 | 2022-03-15 | A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2022-27208 | Medium | 6.5 | 2022-03-15 | Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on the Jenkins controller. |
CVE-2022-27207 | Medium | 4.8 | 2022-03-15 | Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a s… |
CVE-2022-27206 | Medium | 6.5 | 2022-03-15 | Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where… |
CVE-2022-27205 | Medium | 4.3 | 2022-03-15 | A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect… |
CVE-2022-27204 | High | 8.8 | 2022-03-15 | A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers to connect to an attacke… |
CVE-2022-27203 | Medium | 6.5 | 2022-03-15 | Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and… |
CVE-2022-27202 | Medium | 5.4 | 2022-03-15 | Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parameters of radio button… |
CVE-2022-27201 | Medium | 6.5 | 2022-03-15 | Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about t… |
CVE-2022-27200 | Medium | 4.8 | 2022-03-15 | Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulting in a stored cr… |
CVE-2022-27199 | Medium | 4.3 | 2022-03-15 | A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect t… |
CVE-2022-27198 | High | 8.0 | 2022-03-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read… |
CVE-2022-27197 | Medium | 5.4 | 2022-03-15 | Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scr… |
CVE-2022-27196 | Medium | 5.4 | 2022-03-15 | Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerabil… |
CVE-2022-27195 | Medium | 5.5 | 2022-03-15 | Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, inc… |
CVE-2022-25212 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers to connect to an attacker-specified web server usi… |
CVE-2022-25211 | High | 8.8 | 2022-02-15 | A missing permission check in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web serv… |
CVE-2022-25210 | Medium | 6.5 | 2022-02-15 | Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure per… |
CVE-2022-25209 | High | 8.8 | 2022-02-15 | Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-25208 | High | 8.8 | 2022-02-15 | A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request t… |
CVE-2022-25207 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an a… |
CVE-2022-25206 | High | 8.8 | 2022-02-15 | A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDB… |
CVE-2022-25205 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-specified database vi… |
CVE-2022-25204 | Medium | 5.4 | 2022-02-15 | Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc, and err… |
CVE-2022-25203 | Medium | 5.4 | 2022-02-15 | Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers… |
CVE-2022-25202 | Medium | 4.8 | 2022-02-15 | Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-site scripting (XSS) v… |
CVE-2022-25201 | Medium | 6.5 | 2022-02-15 | Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified web… |
CVE-2022-25200 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Checkmarx Plugin 2022.1.2 and earlier allows attackers to connect to an attacker-specified webserv… |
CVE-2022-25199 | High | 8.8 | 2022-02-15 | A missing permission check in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SS… |
CVE-2022-25198 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers to connect to an attacker-specified SSH serv… |
CVE-2022-25197 | Medium | 6.5 | 2022-02-15 | Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins contro… |
CVE-2022-25196 | Medium | 5.4 | 2022-02-15 | Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process start… |
CVE-2022-25195 | Medium | 4.3 | 2022-02-15 | A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL u… |
CVE-2022-25194 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins autonomiq Plugin 1.15 and earlier allows attackers to connect to an attacker-specified URL server… |
CVE-2022-25193 | Medium | 6.5 | 2022-02-15 | Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified we… |
CVE-2022-25192 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Snow Commander Plugin 1.10 and earlier allows attackers to connect to an attacker-specified webser… |
CVE-2022-25191 | Medium | 5.4 | 2022-02-15 | Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (X… |
CVE-2022-25190 | Medium | 4.3 | 2022-02-15 | A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of cr… |
CVE-2022-25189 | Medium | 5.4 | 2022-02-15 | Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site script… |
CVE-2022-25188 | Medium | 4.3 | 2022-02-15 | Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configur… |
CVE-2022-25187 | Medium | 6.5 | 2022-02-15 | Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle. |
CVE-2022-25186 | Medium | 6.5 | 2022-02-15 | Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allow… |
CVE-2022-25185 | Medium | 5.4 | 2022-02-15 | Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS… |
CVE-2022-25184 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Gen… |
CVE-2022-25183 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any san… |
CVE-2022-25182 | High | 8.8 | 2022-02-15 | A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permissio… |
CVE-2022-25181 | High | 8.8 | 2022-02-15 | A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permissio… |
CVE-2022-25180 | Medium | 4.3 | 2022-02-15 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with… |
CVE-2022-25179 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM… |
CVE-2022-25178 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, all… |
CVE-2022-25177 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library whe… |
CVE-2022-25176 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM whe… |
CVE-2022-25175 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing atta… |
CVE-2022-25174 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, all… |
CVE-2022-25173 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jen… |
CVE-2022-0538 | High | 7.5 | 2022-02-09 | Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability… |
CVE-2022-23118 | High | 8.8 | 2022-01-12 | Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path… |
CVE-2022-23117 | High | 7.5 | 2022-01-12 | Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/passwor… |
CVE-2022-23116 | High | 7.5 | 2022-01-12 | Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt secrets stored in Jen… |
CVE-2022-23115 | Medium | 5.4 | 2022-01-12 | Cross-site request forgery (CSRF) vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access to retrieve logs, bui… |
CVE-2022-23114 | Low | 3.3 | 2022-01-12 | Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed… |
CVE-2022-23113 | Medium | 4.3 | 2022-01-12 | Jenkins Publish Over SSH Plugin 1.22 and earlier performs a validation of the file name specifying whether it is present or not, resulting in a path traversal… |
CVE-2022-23112 | Medium | 6.5 | 2022-01-12 | A missing permission check in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers with Overall/Read access to connect to an attacker-specified SS… |
CVE-2022-23111 | Medium | 4.3 | 2022-01-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an attacker-specified SSH… |
CVE-2022-23110 | Medium | 4.8 | 2022-01-12 | Jenkins Publish Over SSH Plugin 1.22 and earlier does not escape the SSH server name, resulting in a stored cross-site scripting (XSS) vulnerability exploitabl… |
CVE-2022-23109 | Medium | 6.5 | 2022-01-12 | Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy… |
CVE-2022-23108 | Medium | 5.4 | 2022-01-12 | Jenkins Badge Plugin 1.9 and earlier does not escape the description and does not check for allowed protocols when creating a badge, resulting in a stored cros… |
CVE-2022-23107 | High | 8.1 | 2022-01-12 | Jenkins Warnings Next Generation Plugin 9.10.2 and earlier does not restrict the name of a file when configuring custom ID, allowing attackers with Item/Config… |
CVE-2022-23106 | Medium | 5.3 | 2022-01-12 | Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers t… |
CVE-2022-23105 | Medium | 6.5 | 2022-01-12 | Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most… |
CVE-2022-20621 | Medium | 5.5 | 2022-01-12 | Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller where it can be viewed b… |
CVE-2022-20620 | Medium | 4.3 | 2022-01-12 | Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials st… |
CVE-2022-20619 | High | 7.1 | 2022-01-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers to connect to an att… |
CVE-2022-20618 | Medium | 4.3 | 2022-01-12 | A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate crede… |
CVE-2022-20617 | High | 8.8 | 2022-01-12 | Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable… |
CVE-2022-20616 | Medium | 4.3 | 2022-01-12 | Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overa… |
CVE-2022-20615 | Medium | 5.4 | 2022-01-12 | Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross… |