Jenkins
Page 10 of 19 — Jenkins CVEs from a corpus of 1822, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21679 | High | 8.8 | 2021-08-31 | Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. |
CVE-2021-21678 | High | 8.8 | 2021-08-31 | Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. |
CVE-2021-21677 | High | 8.8 | 2021-08-31 | Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulti… |
CVE-2021-21676 | Medium | 4.3 | 2021-06-30 | Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to se… |
CVE-2021-21675 | Medium | 6.5 | 2021-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests and/or have administ… |
CVE-2021-21674 | Medium | 4.3 | 2021-06-30 | A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the list of pending reques… |
CVE-2021-21673 | Medium | 6.1 | 2021-06-30 | Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform p… |
CVE-2021-21672 | Medium | 4.3 | 2021-06-30 | Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21671 | High | 7.5 | 2021-06-30 | Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login. |
CVE-2021-21670 | Medium | 4.3 | 2021-06-30 | Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even… |
CVE-2021-21669 | Critical | 9.8 | 2021-06-18 | Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21668 | Medium | 5.4 | 2021-06-16 | Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacker… |
CVE-2021-21667 | Medium | 5.4 | 2021-06-16 | Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vul… |
CVE-2021-21666 | Medium | 6.1 | 2021-06-10 | Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-sit… |
CVE-2021-21665 | High | 8.8 | 2021-06-10 | A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified… |
CVE-2021-21664 | Medium | 6.5 | 2021-06-10 | An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacke… |
CVE-2021-21663 | Medium | 4.3 | 2021-06-10 | A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2021-21662 | Medium | 4.3 | 2021-06-10 | A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID o… |
CVE-2021-21661 | Medium | 4.3 | 2021-06-10 | Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission… |
CVE-2021-21660 | Medium | 5.4 | 2021-05-25 | Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2021-21659 | High | 8.1 | 2021-05-25 | Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21658 | Critical | 9.1 | 2021-05-25 | Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21657 | High | 8.8 | 2021-05-25 | Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21656 | High | 7.1 | 2021-05-11 | Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21655 | High | 7.1 | 2021-05-11 | A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server… |
CVE-2021-21654 | Medium | 4.3 | 2021-05-11 | Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect… |
CVE-2021-21653 | Medium | 4.3 | 2021-05-11 | Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission… |
CVE-2021-21652 | High | 7.1 | 2021-05-11 | A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacke… |
CVE-2021-21651 | Medium | 4.3 | 2021-05-11 | Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obta… |
CVE-2021-21650 | Medium | 4.3 | 2021-05-11 | Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers wi… |
CVE-2021-21649 | Medium | 5.4 | 2021-05-11 | Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vu… |
CVE-2021-21648 | Medium | 6.1 | 2021-05-11 | Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting… |
CVE-2021-21647 | Medium | 4.3 | 2021-04-21 | Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedul… |
CVE-2021-21646 | High | 8.8 | 2021-04-21 | Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configu… |
CVE-2021-21645 | Medium | 4.3 | 2021-04-21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to e… |
CVE-2021-21644 | Medium | 5.4 | 2021-04-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corre… |
CVE-2021-21643 | Medium | 6.5 | 2021-04-21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Jo… |
CVE-2021-21642 | High | 8.1 | 2021-04-21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21641 | Medium | 4.3 | 2021-04-07 | A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds. |
CVE-2021-21640 | Medium | 4.3 | 2021-04-07 | Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create p… |
CVE-2021-21639 | Medium | 4.3 | 2021-04-07 | Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API e… |
CVE-2021-28165 | High | 7.5 | 2021-04-01 | In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame. |
CVE-2021-21638 | High | 8.8 | 2021-03-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-speci… |
CVE-2021-21637 | Medium | 6.5 | 2021-03-30 | A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2021-21636 | Medium | 4.3 | 2021-03-30 | A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enumerate credentials… |
CVE-2021-21635 | Medium | 5.4 | 2021-03-30 | Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site script… |
CVE-2021-21634 | Medium | 6.5 | 2021-03-30 | Jenkins Jabber (XMPP) notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller wher… |
CVE-2021-21633 | High | 8.8 | 2021-03-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specifi… |
CVE-2021-21632 | Medium | 6.5 | 2021-03-30 | A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-s… |
CVE-2021-21631 | Medium | 4.3 | 2021-03-30 | Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and k… |
CVE-2021-21630 | Medium | 5.4 | 2021-03-30 | Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS)… |
CVE-2021-21629 | High | 8.8 | 2021-03-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a project with attacker-spe… |
CVE-2021-21628 | Medium | 5.4 | 2021-03-30 | Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnera… |
CVE-2021-21627 | High | 8.8 | 2021-03-18 | A cross-site request forgery (CSRF) vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domains. |
CVE-2021-21626 | Medium | 4.3 | 2021-03-18 | Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with… |
CVE-2021-21625 | Medium | 4.3 | 2021-03-18 | Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Ov… |
CVE-2021-21624 | Medium | 4.3 | 2021-03-18 | An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to… |
CVE-2021-21623 | Medium | 6.5 | 2021-03-18 | An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to a… |
CVE-2021-21622 | Medium | 5.4 | 2021-02-24 | Jenkins Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XS… |
CVE-2021-21621 | Medium | 5.3 | 2021-02-24 | Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" inform… |
CVE-2021-21620 | Medium | 4.3 | 2021-02-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims. |
CVE-2021-21619 | Medium | 5.4 | 2021-02-24 | Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by at… |
CVE-2021-21618 | Medium | 5.4 | 2021-02-24 | Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a stored cross-site script… |
CVE-2021-21617 | High | 8.8 | 2021-02-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Configuration Slicing Plugin 1.51 and earlier allows attackers to apply different slice configurat… |
CVE-2021-21616 | Medium | 4.6 | 2021-02-24 | Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) vulnerability expl… |
CVE-2021-21615 | Medium | 5.3 | 2021-01-26 | Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use… |
CVE-2021-21614 | Medium | 5.5 | 2021-01-13 | Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be v… |
CVE-2021-21613 | Medium | 6.1 | 2021-01-13 | Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses, resulting in a cross-site scripting (XSS) vulnerability exploitable by attac… |
CVE-2021-21612 | Medium | 5.5 | 2021-01-13 | Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can… |
CVE-2021-21611 | Medium | 5.4 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-… |
CVE-2021-21610 | Medium | 6.1 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query pa… |
CVE-2021-21609 | Medium | 5.3 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without O… |
CVE-2021-21608 | Medium | 5.4 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exp… |
CVE-2021-21607 | Medium | 6.5 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request cra… |
CVE-2021-21606 | Medium | 4.3 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an att… |
CVE-2021-21605 | High | 8.0 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global… |
CVE-2021-21604 | High | 8.0 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old D… |
CVE-2021-21603 | Medium | 5.4 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability. |
CVE-2021-21602 | Medium | 6.5 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following sym… |
CVE-2020-2324 | High | 7.5 | 2020-12-03 | Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2321 | High | 8.1 | 2020-12-03 | A cross-site request forgery (CSRF) vulnerability in Jenkins Shelve Project Plugin 3.0 and earlier allows attackers to shelve, unshelve, or delete a project. |
CVE-2020-2320 | Critical | 9.8 | 2020-12-03 | Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. |
CVE-2020-2319 | Medium | 6.5 | 2020-11-04 | Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controller where it can b… |
CVE-2020-2318 | Medium | 6.5 | 2020-11-04 | Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they… |
CVE-2020-2317 | Medium | 5.4 | 2020-11-04 | Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability ex… |
CVE-2020-2316 | Medium | 5.4 | 2020-11-04 | Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS)… |
CVE-2020-2315 | Medium | 6.5 | 2020-11-04 | Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2314 | Medium | 5.5 | 2020-11-04 | Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by… |
CVE-2020-2313 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of cred… |
CVE-2020-2312 | Medium | 6.5 | 2020-11-04 | Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs. |
CVE-2020-2311 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS c… |
CVE-2020-2310 | Medium | 4.3 | 2020-11-04 | Missing permission checks in Jenkins Ansible Plugin 1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials st… |
CVE-2020-2309 | Medium | 4.3 | 2020-11-04 | A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials… |
CVE-2020-2308 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names. |
CVE-2020-2307 | Medium | 4.3 | 2020-11-04 | Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables. |
CVE-2020-2306 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured M… |
CVE-2020-2305 | Medium | 6.5 | 2020-11-04 | Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2304 | Medium | 6.5 | 2020-11-04 | Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2303 | Medium | 4.3 | 2020-11-04 | A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting… |
CVE-2020-2302 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check… |