Jenkins
Page 3 of 3 — Jenkins CVEs from a corpus of 300, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-23899 | Medium | 6.5 | 2024-01-24 | Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file p… |
CVE-2024-23898 | High | 8.8 | 2024-01-24 | Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI… |
CVE-2024-23897 | Critical | 9.8 | 2024-01-24 | Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path… |
CVE-2023-50779 | Medium | 4.3 | 2023-12-13 | Missing permission checks in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allow attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2023-50778 | High | 8.8 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2023-50777 | Medium | 4.3 | 2023-12-13 | Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potenti… |
CVE-2023-50776 | Medium | 4.3 | 2023-12-13 | Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller where th… |
CVE-2023-50775 | Medium | 4.3 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs. |
CVE-2023-50774 | High | 8.1 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins con… |
CVE-2023-50773 | Medium | 4.3 | 2023-12-13 | Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers… |
CVE-2023-50772 | Medium | 4.3 | 2023-12-13 | Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed… |
CVE-2023-50771 | Medium | 6.1 | 2023-12-13 | Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowin… |
CVE-2023-50770 | Medium | 6.7 | 2023-12-13 | Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format… |
CVE-2023-50769 | Medium | 4.3 | 2023-12-13 | Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to connect to an attacker-specifi… |
CVE-2023-50768 | High | 8.8 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an attacker-specified H… |
CVE-2023-50767 | Medium | 5.4 | 2023-12-13 | Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to send an HTTP request to an att… |
CVE-2023-50766 | High | 8.8 | 2023-12-13 | A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to send an HTTP request to an attacke… |
CVE-2023-50765 | Medium | 4.3 | 2023-12-13 | A missing permission check in Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier allows attackers with Overall/Read permission to read the contents of a G… |
CVE-2023-50764 | High | 8.1 | 2023-12-13 | Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Co… |
CVE-2023-49674 | Medium | 4.3 | 2023-11-29 | A missing permission check in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers with Overall/Read permission to connect to an at… |
CVE-2023-49673 | High | 8.8 | 2023-11-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker… |
CVE-2023-49656 | Critical | 9.8 | 2023-11-29 | Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-49655 | High | 8.8 | 2023-11-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins MATLAB Plugin 2.11.0 and earlier allows attackers to have Jenkins parse an XML file from the Jenki… |
CVE-2023-49654 | Critical | 9.8 | 2023-11-29 | Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system. |
CVE-2023-49653 | Medium | 6.5 | 2023-11-29 | Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access a… |
CVE-2023-49652 | Low | 2.7 | 2023-11-29 | Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (w… |
CVE-2023-46660 | Medium | 5.3 | 2023-10-25 | Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equ… |
CVE-2023-46659 | Medium | 5.4 | 2023-10-25 | Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripting (XSS) vulnerab… |
CVE-2023-46658 | Medium | 5.3 | 2023-10-25 | Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook t… |
CVE-2023-46657 | Medium | 5.3 | 2023-10-25 | Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, po… |
CVE-2023-46656 | Medium | 5.3 | 2023-10-25 | Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the provided and expected… |
CVE-2023-46655 | Medium | 6.5 | 2023-10-25 | Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are published during the 'Clou… |
CVE-2023-46654 | High | 8.1 | 2023-10-25 | Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the 'CloudBe… |
CVE-2023-46653 | Medium | 6.5 | 2023-10-25 | Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure. |
CVE-2023-46652 | Medium | 4.3 | 2023-10-25 | A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enumerate credentials ID… |
CVE-2023-46651 | Medium | 6.5 | 2023-10-25 | Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to ac… |
CVE-2023-46650 | Medium | 5.4 | 2023-10-25 | Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a stored cross-site script… |
CVE-2023-36478 | High | 7.5 | 2023-10-10 | Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer ove… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2023-43502 | Medium | 4.3 | 2023-09-20 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes. |
CVE-2023-43501 | Medium | 6.5 | 2023-09-20 | A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-s… |
CVE-2023-43500 | High | 8.8 | 2023-09-20 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specifi… |
CVE-2023-43499 | Medium | 5.4 | 2023-09-20 | Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vul… |
CVE-2023-43498 | High | 8.1 | 2023-09-20 | In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temp… |
CVE-2023-43497 | High | 8.1 | 2023-09-20 | In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system te… |
CVE-2023-43496 | High | 8.8 | 2023-09-20 | Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created fi… |
CVE-2023-43495 | Medium | 5.4 | 2023-09-20 | Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a… |
CVE-2023-43494 | Medium | 4.3 | 2023-09-20 | Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter v… |
CVE-2023-41947 | Medium | 4.3 | 2023-09-06 | A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frugal Testing using at… |
CVE-2023-41946 | Low | 3.5 | 2023-09-06 | A cross-site request forgery (CSRF) vulnerability in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers to connect to Frugal Testing using attacker… |
CVE-2023-41945 | High | 8.8 | 2023-09-06 | Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be grante… |
CVE-2023-41944 | Medium | 6.1 | 2023-09-06 | Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error mess… |
CVE-2023-41943 | Medium | 6.5 | 2023-09-06 | Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permissi… |
CVE-2023-41942 | Medium | 4.3 | 2023-09-06 | A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue. |
CVE-2023-41941 | Medium | 4.3 | 2023-09-06 | A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumerate credentials I… |
CVE-2023-41940 | Medium | 5.4 | 2023-09-06 | Jenkins TAP Plugin 2.3 and earlier does not escape TAP file contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers a… |
CVE-2023-41939 | High | 8.8 | 2023-09-06 | Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (ty… |
CVE-2023-41938 | Medium | 6.5 | 2023-09-06 | A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules. |
CVE-2023-41937 | High | 7.5 | 2023-09-06 | Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and… |
CVE-2023-41936 | High | 7.5 | 2023-09-06 | Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, poten… |
CVE-2023-41935 | High | 7.5 | 2023-09-06 | Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the… |
CVE-2023-41934 | Medium | 5.3 | 2023-09-06 | Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specifi… |
CVE-2023-41933 | High | 8.8 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-41932 | Medium | 6.5 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attacke… |
CVE-2023-41931 | Medium | 5.4 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when ren… |
CVE-2023-41930 | Medium | 4.3 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing… |
CVE-2023-4303 | Medium | 4.3 | 2023-08-21 | Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vulnerability. |
CVE-2023-4302 | Medium | 4.2 | 2023-08-21 | A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2023-4301 | Medium | 4.2 | 2023-08-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers to connect to an attacker-specified URL using… |
CVE-2023-40351 | Medium | 4.3 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Favorite View Plugin 5.v77a_37f62782d and earlier allows attackers to add or remove views from ano… |
CVE-2023-40350 | Medium | 5.4 | 2023-08-16 | Jenkins Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view, resulting… |
CVE-2023-40349 | Medium | 5.3 | 2023-08-16 | Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of… |
CVE-2023-40348 | Medium | 5.3 | 2023-08-16 | The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output. |
CVE-2023-40347 | Medium | 6.5 | 2023-08-16 | Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowing attackers with… |
CVE-2023-40346 | Medium | 5.4 | 2023-08-16 | Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting (XSS) vulnerability exploi… |
CVE-2023-40345 | Medium | 6.5 | 2023-08-16 | Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Overall/Read permission to access… |
CVE-2023-40344 | Medium | 4.3 | 2023-08-16 | A missing permission check in Jenkins Delphix Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credential… |
CVE-2023-40343 | Medium | 5.9 | 2023-08-16 | Jenkins Tuleap Authentication Plugin 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token allowing attackers… |
CVE-2023-40342 | Medium | 5.4 | 2023-08-16 | Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI, resulting in a stored cross-site s… |
CVE-2023-40341 | High | 8.8 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, cap… |
CVE-2023-40340 | High | 7.5 | 2023-08-16 | Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask (i.e., replace with asterisks) credentials specified in the Npm config file in Pipeline build lo… |
CVE-2023-40339 | High | 7.5 | 2023-08-16 | Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files… |
CVE-2023-40338 | Medium | 4.3 | 2023-08-16 | Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Sca… |
CVE-2023-40337 | Medium | 4.3 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder. |
CVE-2023-40336 | High | 8.8 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders. |
CVE-2023-3442 | High | 7.7 | 2023-07-26 | A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could ca… |
CVE-2023-3414 | Medium | 6.1 | 2023-07-26 | A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, cou… |
CVE-2023-39156 | Medium | 5.3 | 2023-07-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags. |
CVE-2023-39155 | Medium | 5.3 | 2023-07-26 | Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it. |
CVE-2023-39154 | Medium | 6.5 | 2023-07-26 | Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to con… |
CVE-2023-39153 | Medium | 5.4 | 2023-07-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to… |
CVE-2023-39152 | Medium | 6.5 | 2023-07-26 | Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the bui… |
CVE-2023-39151 | Medium | 5.4 | 2023-07-26 | Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in… |
CVE-2023-37965 | High | 7.1 | 2023-07-12 | A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2023-37964 | High | 8.8 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attacker-specified URL us… |
CVE-2023-37963 | Medium | 5.4 | 2023-07-12 | A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2023-37962 | High | 8.8 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified… |
CVE-2023-37961 | High | 8.8 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Auth Plugin 1.14 and earlier allows attackers to trick users into logging in to the attac… |
CVE-2023-37960 | Medium | 6.5 | 2023-07-12 | Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins contr… |
CVE-2023-37959 | Medium | 6.5 | 2023-07-12 | A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-spec… |