Jenkins
Page 18 of 19 — Jenkins CVEs from a corpus of 1822, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1000388 | Medium | 4.3 | 2018-01-26 | Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing any… |
CVE-2017-1000387 | High | 7.8 | 2018-01-26 | Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher… |
CVE-2017-1000386 | Medium | 5.4 | 2018-01-26 | Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Pa… |
CVE-2017-1000505 | Medium | 6.5 | 2018-01-25 | In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion featur… |
CVE-2017-1000504 | High | 8.1 | 2018-01-24 | A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. Th… |
CVE-2017-1000503 | High | 8.1 | 2018-01-24 | A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of execution of commands during initialization. T… |
CVE-2017-1000502 | High | 8.8 | 2018-01-24 | Users with permission to create or configure agents in Jenkins 1.37 and earlier could configure an EC2 agent to run arbitrary shell commands on the master node… |
CVE-2018-1000015 | Medium | 4.8 | 2018-01-23 | On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. This did… |
CVE-2018-1000014 | High | 8.8 | 2018-01-23 | Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing at… |
CVE-2018-1000013 | High | 8.8 | 2018-01-23 | Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to trigg… |
CVE-2018-1000012 | High | 8.8 | 2018-01-23 | Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissi… |
CVE-2018-1000011 | High | 8.8 | 2018-01-23 | Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissi… |
CVE-2018-1000010 | High | 8.8 | 2018-01-23 | Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions i… |
CVE-2018-1000009 | High | 8.8 | 2018-01-23 | Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permis… |
CVE-2018-1000008 | High | 8.8 | 2018-01-23 | Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions i… |
CVE-2017-17383 | Medium | 4.7 | 2017-12-06 | Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, as demonstrated by… |
CVE-2017-1000245 | Critical | 9.8 | 2017-11-01 | The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are sto… |
CVE-2017-1000244 | High | 8.8 | 2017-11-01 | Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification |
CVE-2017-1000243 | Medium | 4.3 | 2017-11-01 | Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites |
CVE-2017-1000242 | Low | 3.3 | 2017-11-01 | Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure |
CVE-2017-1000114 | Low | 3.1 | 2017-10-05 | The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk, it was t… |
CVE-2017-1000113 | Medium | 5.5 | 2017-10-05 | The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or u… |
CVE-2017-1000110 | Medium | 4.3 | 2017-10-05 | Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsf… |
CVE-2017-1000109 | Medium | 6.1 | 2017-10-05 | The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scripting vulnerability… |
CVE-2017-1000108 | High | 7.5 | 2017-10-05 | The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed… |
CVE-2017-1000107 | High | 8.8 | 2017-10-05 | Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method re… |
CVE-2017-1000106 | High | 8.5 | 2017-10-05 | Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsf… |
CVE-2017-1000105 | Medium | 5.3 | 2017-10-05 | The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before providing access to arc… |
CVE-2017-1000104 | Medium | 6.5 | 2017-10-05 | The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with only Overall/Read acc… |
CVE-2017-1000103 | Medium | 5.4 | 2017-10-05 | The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users ab… |
CVE-2017-1000102 | Medium | 5.4 | 2017-10-05 | The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to inf… |
CVE-2017-1000096 | High | 8.8 | 2017-10-05 | Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were… |
CVE-2017-1000095 | Medium | 6.5 | 2017-10-05 | The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). Th… |
CVE-2017-1000094 | Medium | 6.5 | 2017-10-05 | Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to authenticate with a… |
CVE-2017-1000093 | High | 8.8 | 2017-10-05 | Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to… |
CVE-2017-1000092 | High | 7.5 | 2017-10-05 | Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username… |
CVE-2017-1000091 | Medium | 6.3 | 2017-10-05 | GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan… |
CVE-2017-1000090 | High | 8.8 | 2017-10-05 | Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks… |
CVE-2017-1000089 | Medium | 5.3 | 2017-10-05 | Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeli… |
CVE-2017-1000088 | Medium | 5.4 | 2017-10-05 | The Sidebar Link plugin allows users able to configure jobs, views, and agents to add entries to the sidebar of these objects. There was no input validation, w… |
CVE-2017-1000087 | Medium | 4.3 | 2017-10-05 | GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did… |
CVE-2017-1000086 | High | 8.0 | 2017-10-05 | The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore b… |
CVE-2017-1000085 | Medium | 6.5 | 2017-10-05 | Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperl… |
CVE-2017-1000084 | Medium | 6.5 | 2017-10-05 | Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was running as an… |
CVE-2014-9635 | Medium | 5.3 | 2017-09-12 | Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for re… |
CVE-2014-9634 | Medium | 5.3 | 2017-09-12 | Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture… |
CVE-2017-1000362 | Critical | 9.8 | 2017-07-17 | The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup directory with a… |
CVE-2016-4988 | Medium | 6.1 | 2017-02-09 | Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script o… |
CVE-2016-4987 | Medium | 6.5 | 2017-02-09 | Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories and read arbitrary fi… |
CVE-2016-4986 | High | 7.5 | 2017-02-09 | Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecified parameter. |
CVE-2016-3102 | High | 7.3 | 2017-02-09 | The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1)… |
CVE-2016-3101 | Medium | 5.4 | 2017-02-09 | Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web script or HTML by l… |
CVE-2016-9299 | Critical | 9.8 | 2017-01-12 | The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which… |
CVE-2016-3727 | Medium | 4.3 | 2016-05-17 | The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the mast… |
CVE-2016-3726 | High | 7.4 | 2016-05-17 | Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct… |
CVE-2016-3725 | Medium | 4.3 | 2016-05-17 | Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missing permissions che… |
CVE-2016-3724 | Medium | 6.5 | 2016-05-17 | Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job… |
CVE-2016-3723 | Medium | 4.3 | 2016-05-17 | Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging m… |
CVE-2016-3722 | Medium | 4.3 | 2016-05-17 | Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the… |
CVE-2016-3721 | Medium | 4.3 | 2016-05-17 | Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environmen… |
CVE-2016-0792 | High | 8.8 | 2016-04-07 | Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized dat… |
CVE-2016-0791 | Critical | 9.8 | 2016-04-07 | Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a… |
CVE-2016-0790 | Medium | 5.3 | 2016-04-07 | Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine… |
CVE-2016-0789 | Medium | 6.1 | 2016-04-07 | CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP h… |
CVE-2016-0788 | Critical | 9.8 | 2016-04-07 | The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener. |
CVE-2015-7539 | High | 7.5 | 2016-02-03 | The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it ea… |
CVE-2015-7538 | High | 8.8 | 2016-02-03 | Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors. |
CVE-2015-7537 | High | 8.8 | 2016-02-03 | Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administ… |
CVE-2015-7536 | Medium | 5.4 | 2016-02-03 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTM… |
CVE-2015-8103 | Critical | 9.8 | 2015-11-25 | The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object… |
CVE-2015-5326 | | 2015-11-25 | Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certa… | |
CVE-2015-5325 | | 2015-11-25 | Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulne… | |
CVE-2015-5324 | | 2015-11-25 | Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api. | |
CVE-2015-5323 | | 2015-11-25 | Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run sc… | |
CVE-2015-5322 | | 2015-11-25 | Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in… | |
CVE-2015-5321 | | 2015-11-25 | The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive info… | |
CVE-2015-5320 | | 2015-11-25 | Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect a… | |
CVE-2015-5319 | | 2015-11-25 | XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary… | |
CVE-2015-5318 | | 2015-11-25 | Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to b… | |
CVE-2015-5317 | High | 7.5 | 2015-11-25 | The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a dir… |
CVE-2014-3665 | | 2015-11-25 | Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote attackers to execute… | |
CVE-2015-1814 | | 2015-10-16 | The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involvi… | |
CVE-2015-1813 | | 2015-10-16 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unsp… | |
CVE-2015-1812 | | 2015-10-16 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unsp… | |
CVE-2015-1810 | | 2015-10-16 | The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own use… | |
CVE-2015-1808 | | 2015-10-16 | Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted… | |
CVE-2015-1807 | | 2015-10-16 | Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary f… | |
CVE-2015-1806 | | 2015-10-16 | The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain… | |
CVE-2014-2068 | | 2014-10-17 | The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with th… | |
CVE-2014-2066 | | 2014-10-17 | Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "overrid… | |
CVE-2014-2065 | | 2014-10-17 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the… | |
CVE-2014-2064 | | 2014-10-17 | The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to de… | |
CVE-2014-2063 | | 2014-10-17 | Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors. | |
CVE-2014-2062 | | 2014-10-17 | Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access… | |
CVE-2014-2061 | | 2014-10-17 | The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML… | |
CVE-2014-2060 | | 2014-10-17 | The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors. | |
CVE-2014-2058 | | 2014-10-17 | BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by confi… | |
CVE-2013-7330 | | 2014-10-17 | Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actions. | |
CVE-2014-3680 | | 2014-10-16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field o… | |
CVE-2014-3667 | | 2014-10-16 | Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ per… |