Jenkins
Page 17 of 19 — Jenkins CVEs from a corpus of 1822, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1000608 | High | 7.2 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with loca… |
CVE-2018-1000607 | Medium | 6.5 | 2018-06-26 | A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rul… |
CVE-2018-1000606 | Medium | 6.5 | 2018-06-26 | A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read acc… |
CVE-2018-1000605 | High | 7.4 | 2018-06-26 | A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java th… |
CVE-2018-1000604 | Medium | 5.4 | 2018-06-26 | A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows atta… |
CVE-2018-1000603 | High | 8.8 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins Openstack Cloud Plugin 2.35 and earlier in BootSource.java, InstancesToRun.java, JCloudsCle… |
CVE-2018-1000602 | Medium | 5.9 | 2018-06-26 | A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate an… |
CVE-2018-1000601 | Medium | 6.5 | 2018-06-26 | A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenki… |
CVE-2018-1000600 | High | 8.8 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attacker… |
CVE-2018-1000202 | Medium | 5.4 | 2018-06-05 | A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to c… |
CVE-2018-1000198 | Medium | 6.5 | 2018-06-05 | A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers wi… |
CVE-2018-1000197 | High | 8.1 | 2018-06-05 | An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/… |
CVE-2018-1000196 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_notifier/global.erb… |
CVE-2018-1000195 | Medium | 4.3 | 2018-06-05 | A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Over… |
CVE-2018-1000194 | High | 8.1 | 2018-06-05 | A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents… |
CVE-2018-1000193 | Medium | 4.3 | 2018-06-05 | A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that a… |
CVE-2018-1000192 | Medium | 4.3 | 2018-06-05 | A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users w… |
CVE-2018-1000191 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins Black Duck Detect Plugin 1.4.0 and older in DetectPostBuildStepDescriptor.java that allows… |
CVE-2018-1000190 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java that allows attackers… |
CVE-2018-1000189 | High | 8.8 | 2018-06-05 | A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with Overall/Read access t… |
CVE-2018-1000188 | Medium | 5.4 | 2018-06-05 | A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers with Overall/Read acces… |
CVE-2018-1000187 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that results in sensitive… |
CVE-2018-1000186 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.java that allows att… |
CVE-2018-1000185 | Medium | 4.3 | 2018-06-05 | A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/R… |
CVE-2018-1000184 | Medium | 5.4 | 2018-06-05 | A server-side request forgery vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubPluginConfig.java that allows attackers with Overall/Read… |
CVE-2018-1000183 | Medium | 6.5 | 2018-06-05 | A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows attackers with Overal… |
CVE-2018-1000182 | Medium | 6.4 | 2018-06-05 | A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2… |
CVE-2017-2598 | Medium | 4.3 | 2018-05-23 | Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to… |
CVE-2017-2609 | Medium | 4.3 | 2018-05-22 | jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on… |
CVE-2017-2607 | Medium | 4.2 | 2018-05-21 | jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to… |
CVE-2017-2613 | Medium | 5.4 | 2018-05-15 | jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most… |
CVE-2017-2610 | Medium | 5.4 | 2018-05-15 | jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than an… |
CVE-2017-2604 | Medium | 4.3 | 2018-05-15 | In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permiss… |
CVE-2017-2603 | Low | 2.6 | 2018-05-15 | Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API token… |
CVE-2017-2602 | Low | 3.1 | 2018-05-15 | jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This c… |
CVE-2017-2612 | Medium | 5.4 | 2018-05-15 | In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in future builds possibly… |
CVE-2017-2608 | High | 8.8 | 2018-05-15 | Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in… |
CVE-2017-2600 | Medium | 4.3 | 2018-05-15 | In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and ru… |
CVE-2017-2601 | Medium | 5.4 | 2018-05-10 | Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permi… |
CVE-2017-2606 | Medium | 4.3 | 2018-05-08 | Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible (… |
CVE-2017-2611 | Medium | 4.3 | 2018-05-08 | Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /f… |
CVE-2018-1000177 | Medium | 5.4 | 2018-05-08 | A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jel… |
CVE-2018-1000176 | Medium | 6.5 | 2018-05-08 | An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/Extend… |
CVE-2018-1000175 | Medium | 6.5 | 2018-05-08 | A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers able to configure the H… |
CVE-2018-1000174 | Medium | 6.1 | 2018-05-08 | An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to… |
CVE-2018-1000173 | Medium | 5.9 | 2018-05-08 | A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to i… |
CVE-2018-1000170 | Medium | 5.4 | 2018-04-16 | A cross-site scripting vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in confirmationList.jelly and stopButton.jelly that allows attac… |
CVE-2018-1000169 | Medium | 5.3 | 2018-04-16 | An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptionHandler.java that… |
CVE-2017-2599 | Medium | 5.4 | 2018-04-11 | Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) t… |
CVE-2018-1000153 | High | 8.8 | 2018-04-05 | A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java… |
CVE-2018-1000152 | Medium | 6.3 | 2018-04-05 | An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, Con… |
CVE-2018-1000151 | Medium | 5.6 | 2018-04-05 | A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default. |
CVE-2018-1000150 | Low | 3.3 | 2018-04-05 | An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#authContext that allo… |
CVE-2018-1000149 | Medium | 5.6 | 2018-04-05 | A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdH… |
CVE-2018-1000148 | Medium | 6.5 | 2018-04-05 | An exposure of sensitive information vulnerability exists in Jenkins Copy To Slave Plugin version 1.4.4 and older in CopyToSlaveBuildWrapper.java that allows a… |
CVE-2018-1000146 | High | 8.8 | 2018-04-05 | An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs t… |
CVE-2018-1000145 | Medium | 6.5 | 2018-04-05 | An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows att… |
CVE-2018-1000144 | Medium | 6.1 | 2018-04-05 | A cross site scripting vulnerability exists in Jenkins Cucumber Living Documentation Plugin 1.0.12 and older in CukedoctorBaseAction#doDynamic that disables th… |
CVE-2018-1000143 | Medium | 6.7 | 2018-04-05 | An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows… |
CVE-2018-1000142 | High | 7.8 | 2018-04-05 | An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows… |
CVE-2018-8718 | High | 8.0 | 2018-03-27 | Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an a… |
CVE-2018-1000114 | Medium | 4.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java that allow an attac… |
CVE-2018-1000113 | Medium | 5.4 | 2018-03-13 | A cross-site scripting vulnerability exists in Jenkins TestLink Plugin 2.12 and earlier in TestLinkBuildAction/summary.jelly and others that allow an attacker… |
CVE-2018-1000112 | Medium | 5.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an attacker with network… |
CVE-2018-1000111 | Medium | 5.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and SubversionRepositoryStatus… |
CVE-2018-1000110 | Medium | 5.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to… |
CVE-2018-1000109 | Medium | 4.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in GooglePlayBuildStepDescriptor.java th… |
CVE-2018-1000108 | Medium | 6.1 | 2018-03-13 | A cross-site scripting vulnerability exists in Jenkins CppNCSS Plugin 1.1 and earlier in AbstractProjectAction/index.jelly that allow an attacker to craft link… |
CVE-2018-1000107 | Medium | 6.5 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Job and Node Ownership Plugin 0.11.0 and earlier in OwnershipDescription.java, JobOwnerJobProperty.ja… |
CVE-2018-1000106 | Medium | 5.4 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl… |
CVE-2018-1000105 | Medium | 4.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl… |
CVE-2018-1000104 | High | 7.8 | 2018-03-13 | A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local fil… |
CVE-2018-6356 | Medium | 6.5 | 2018-02-20 | Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin re… |
CVE-2018-1000068 | Medium | 5.3 | 2018-02-16 | An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin r… |
CVE-2018-1000067 | Medium | 5.3 | 2018-02-16 | An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submi… |
CVE-2018-1000058 | High | 8.8 | 2018-02-09 | Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deseri… |
CVE-2018-1000057 | Medium | 4.3 | 2018-02-09 | Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided pas… |
CVE-2018-1000056 | High | 8.3 | 2018-02-09 | Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions… |
CVE-2018-1000055 | High | 8.3 | 2018-02-09 | Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permi… |
CVE-2018-1000054 | High | 8.3 | 2018-02-09 | Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in… |
CVE-2017-1000356 | High | 8.8 | 2018-01-29 | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication realm: create an acc… |
CVE-2017-1000355 | Medium | 6.5 | 2018-01-29 | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void. |
CVE-2017-1000354 | High | 8.8 | 2018-01-29 | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkins user. The `login`… |
CVE-2017-1000353 | Critical | 9.8 | 2018-01-29 | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code… |
CVE-2017-1000404 | Medium | 6.1 | 2018-01-26 | The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScript, resulting in a… |
CVE-2017-1000403 | High | 8.8 | 2018-01-26 | Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM, effectively eleva… |
CVE-2017-1000402 | Medium | 5.9 | 2018-01-26 | Jenkins Swarm Plugin Client 3.4 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified… |
CVE-2017-1000401 | Low | 2.2 | 2018-01-26 | The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API ke… |
CVE-2017-1000400 | Medium | 4.3 | 2018-01-26 | The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included… |
CVE-2017-1000399 | Medium | 4.3 | 2018-01-26 | The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically builds waiting to st… |
CVE-2017-1000398 | Medium | 4.3 | 2018-01-26 | The remote API in Jenkins 2.73.1 and earlier, 2.83 and earlier at /computer/(agent-name)/api showed information about tasks (typically builds) currently runnin… |
CVE-2017-1000397 | Medium | 5.9 | 2018-01-26 | Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL ce… |
CVE-2017-1000396 | Medium | 5.9 | 2018-01-26 | Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified… |
CVE-2017-1000395 | Medium | 4.3 | 2018-01-26 | Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Overall/Read permissi… |
CVE-2017-1000394 | High | 7.5 | 2018-01-26 | Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability known as CVE-2016-309… |
CVE-2017-1000393 | High | 8.8 | 2018-01-26 | Jenkins 2.73.1 and earlier, 2.83 and earlier users with permission to create or configure agents in Jenkins could configure a launch method called 'Launch agen… |
CVE-2017-1000392 | Medium | 4.8 | 2018-01-26 | Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnera… |
CVE-2017-1000391 | High | 7.3 | 2018-01-26 | Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearin… |
CVE-2017-1000390 | Medium | 4.3 | 2018-01-26 | Jenkins Multijob plugin version 1.25 and earlier did not check permissions in the Resume Build action, allowing anyone with Job/Read permission to resume the b… |
CVE-2017-1000389 | Medium | 6.1 | 2018-01-26 | Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had… |