Jenkins
Page 16 of 19 — Jenkins CVEs from a corpus of 1822, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1003041 | Critical | 9.8 | 2019-03-28 | A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts. |
CVE-2019-1003040 | Critical | 9.8 | 2019-03-28 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts. |
CVE-2019-1003039 | High | 8.8 | 2019-03-08 | An insufficiently protected credentials vulnerability exists in JenkinsAppDynamics Dashboard Plugin 1.0.14 and earlier in src/main/java/nl/codecentric/jenkins/… |
CVE-2019-1003038 | High | 7.8 | 2019-03-08 | An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins… |
CVE-2019-1003037 | Medium | 6.5 | 2019-03-08 | An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java… |
CVE-2019-1003036 | Medium | 4.3 | 2019-03-08 | A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgent.java tha… |
CVE-2019-1003035 | Medium | 4.3 | 2019-03-08 | An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgentTempl… |
CVE-2019-1003034 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.g… |
CVE-2019-1003033 | High | 8.8 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that all… |
CVE-2019-1003032 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublish… |
CVE-2019-1003031 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows a… |
CVE-2019-1003030 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroov… |
CVE-2019-1003029 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/G… |
CVE-2019-1003028 | Medium | 4.3 | 2019-02-20 | A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthen… |
CVE-2019-1003027 | Medium | 4.3 | 2019-02-20 | A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allows attackers with Ove… |
CVE-2019-1003026 | Medium | 4.3 | 2019-02-20 | A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers… |
CVE-2019-1003025 | High | 8.8 | 2019-02-20 | A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allo… |
CVE-2019-1003024 | High | 8.8 | 2019-02-20 | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overa… |
CVE-2019-1003023 | Medium | 6.1 | 2019-02-06 | A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/mode… |
CVE-2019-1003022 | Medium | 6.5 | 2019-02-06 | A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on th… |
CVE-2019-1003021 | Medium | 4.3 | 2019-02-06 | An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that… |
CVE-2019-1003020 | Medium | 4.3 | 2019-02-06 | A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that allows attackers with… |
CVE-2019-1003019 | Medium | 5.9 | 2019-02-06 | An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attacker… |
CVE-2019-1003018 | Medium | 4.3 | 2019-02-06 | An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that all… |
CVE-2019-1003017 | Medium | 5.3 | 2019-02-06 | A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconf… |
CVE-2019-1003016 | High | 8.8 | 2019-02-06 | An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImp… |
CVE-2019-1003015 | Critical | 9.1 | 2019-02-06 | An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/Re… |
CVE-2019-1003014 | Medium | 4.8 | 2019-02-06 | An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly t… |
CVE-2019-1003013 | Medium | 5.4 | 2019-02-06 | An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/s… |
CVE-2019-1003012 | Medium | 6.5 | 2019-02-06 | A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/j… |
CVE-2019-1003011 | High | 8.1 | 2019-02-06 | An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenma… |
CVE-2019-1003010 | Medium | 4.3 | 2019-02-06 | A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows att… |
CVE-2019-1003009 | High | 7.4 | 2019-02-06 | An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/Ac… |
CVE-2019-1003008 | High | 8.8 | 2019-02-06 | A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/war… |
CVE-2019-1003007 | High | 8.8 | 2019-02-06 | A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that… |
CVE-2019-1003006 | High | 8.8 | 2019-02-06 | A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attac… |
CVE-2019-1003005 | High | 8.8 | 2019-02-06 | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/S… |
CVE-2018-1000997 | Medium | 6.5 | 2019-01-23 | A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke… |
CVE-2019-1003004 | High | 7.2 | 2019-01-22 | An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProces… |
CVE-2019-1003003 | High | 7.2 | 2019-01-22 | An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMe… |
CVE-2019-1003002 | High | 8.8 | 2019-01-22 | A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipe… |
CVE-2019-1003001 | High | 8.8 | 2019-01-22 | A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, s… |
CVE-2019-1003000 | High | 8.8 | 2019-01-22 | A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySan… |
CVE-2018-1000426 | Medium | 6.1 | 2019-01-09 | A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftside… |
CVE-2018-1000417 | High | 8.1 | 2019-01-09 | A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.java that allows cre… |
CVE-2018-1000414 | High | 8.1 | 2019-01-09 | A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction… |
CVE-2018-1000413 | Medium | 5.4 | 2019-01-09 | A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users w… |
CVE-2018-1000412 | High | 8.8 | 2019-01-09 | An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have… |
CVE-2018-1000411 | Medium | 6.5 | 2019-01-09 | A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test res… |
CVE-2018-1000410 | High | 7.8 | 2019-01-09 | An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/s… |
CVE-2018-1000409 | Medium | 5.4 | 2019-01-09 | A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm… |
CVE-2018-1000408 | Medium | 6.5 | 2019-01-09 | A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm… |
CVE-2018-1000407 | Medium | 6.1 | 2019-01-09 | A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attac… |
CVE-2018-1000406 | Medium | 6.5 | 2019-01-09 | A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that all… |
CVE-2018-1000866 | High | 8.8 | 2018-12-10 | A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer… |
CVE-2018-1000865 | High | 8.8 | 2018-12-10 | A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer… |
CVE-2018-1000864 | Medium | 6.5 | 2018-12-10 | A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permissi… |
CVE-2018-1000863 | High | 8.2 | 2018-12-10 | A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit cr… |
CVE-2018-1000862 | Medium | 4.3 | 2018-12-10 | An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with t… |
CVE-2018-1000861 | Critical | 9.8 | 2018-12-10 | A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org… |
CVE-2018-1999047 | Medium | 6.5 | 2018-08-23 | A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers to cancel a Jenkins… |
CVE-2018-1999046 | Medium | 4.3 | 2018-08-23 | A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attackers With Overall/… |
CVE-2018-1999045 | Medium | 5.4 | 2018-08-23 | A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that… |
CVE-2018-1999044 | Medium | 6.5 | 2018-08-23 | A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overall/Read permission t… |
CVE-2018-1999043 | High | 7.5 | 2018-08-23 | A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator… |
CVE-2018-1999042 | Medium | 5.3 | 2018-08-23 | A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when dese… |
CVE-2017-2654 | Low | 3.7 | 2018-08-06 | jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created l… |
CVE-2018-1999041 | Medium | 5.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attacker… |
CVE-2018-1999040 | High | 8.8 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to capt… |
CVE-2018-1999039 | Medium | 4.3 | 2018-08-01 | A server-side request forgery vulnerability exists in Jenkins Confluence Publisher Plugin 2.0.1 and earlier in ConfluenceSite.java that allows attackers to hav… |
CVE-2018-1999038 | Medium | 4.2 | 2018-08-01 | A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to ha… |
CVE-2018-1999037 | Medium | 4.3 | 2018-08-01 | A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop track… |
CVE-2018-1999036 | Medium | 6.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH priva… |
CVE-2018-1999035 | High | 7.4 | 2018-08-01 | A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMas… |
CVE-2018-1999034 | High | 7.4 | 2018-08-01 | A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that all… |
CVE-2018-1999031 | Medium | 6.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that allows attackers with… |
CVE-2018-1999030 | Medium | 5.4 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in ArtifactoryChoiceLis… |
CVE-2018-1999029 | Medium | 5.4 | 2018-08-01 | A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.je… |
CVE-2018-1999028 | High | 8.8 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackers to capture cred… |
CVE-2018-1999027 | High | 7.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows at… |
CVE-2018-1999026 | Medium | 6.5 | 2018-08-01 | A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Je… |
CVE-2018-1999025 | High | 7.4 | 2018-08-01 | A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java that allows attackers t… |
CVE-2017-2652 | High | 8.8 | 2018-07-27 | It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork C… |
CVE-2017-2650 | High | 8.5 | 2018-07-27 | It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commit access, as well… |
CVE-2017-2649 | High | 8.1 | 2018-07-27 | It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby e… |
CVE-2017-2648 | Medium | 6.8 | 2018-07-27 | It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks. |
CVE-2017-2651 | Low | 3.7 | 2018-07-27 | jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of us… |
CVE-2018-1999007 | Medium | 5.4 | 2018-07-23 | A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java t… |
CVE-2018-1999006 | Medium | 4.3 | 2018-07-23 | A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackers to determine th… |
CVE-2018-1999005 | Medium | 5.4 | 2018-07-23 | A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidget/control.jelly th… |
CVE-2018-1999004 | Medium | 4.3 | 2018-07-23 | A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read p… |
CVE-2018-1999003 | Medium | 4.3 | 2018-07-23 | A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permissio… |
CVE-2018-1999002 | High | 7.5 | 2018-07-23 | A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java th… |
CVE-2018-1999001 | High | 8.8 | 2018-07-23 | A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allows attackers to provi… |
CVE-2018-1000404 | High | 7.8 | 2018-07-09 | Jenkins project Jenkins AWS CodeBuild Plugin version 0.26 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSClientFactory.java, C… |
CVE-2018-1000403 | High | 7.8 | 2018-07-09 | Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodeDeployPublisher… |
CVE-2018-1000402 | Medium | 4.3 | 2018-07-09 | Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a File and Directory Information Exposure vulnerability in AWSCodeDeployPublish… |
CVE-2018-1000401 | High | 7.8 | 2018-07-09 | Jenkins project Jenkins AWS CodePipeline Plugin version 0.36 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodePipelineSCM.ja… |
CVE-2018-1000610 | High | 8.8 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute… |
CVE-2018-1000609 | Medium | 6.5 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows… |