Vulnerabilities (CVE)

Filtered by vendor Jenkins Subscribe
Total 1331 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-21679 1 Jenkins 1 Azure Ad 2022-10-25 6.8 MEDIUM 8.8 HIGH
Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.
CVE-2021-21678 1 Jenkins 1 Saml 2022-10-25 6.8 MEDIUM 8.8 HIGH
Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.
CVE-2021-21621 1 Jenkins 1 Support Core 2022-10-25 5.0 MEDIUM 5.3 MEDIUM
Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" information, which can include the session ID of the user creating the support bundle in some configurations.
CVE-2021-21693 1 Jenkins 1 Jenkins 2022-10-25 7.5 HIGH 9.8 CRITICAL
When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
CVE-2021-21684 1 Jenkins 1 Git 2022-10-25 4.3 MEDIUM 6.1 MEDIUM
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
CVE-2021-21605 1 Jenkins 1 Jenkins 2022-10-24 6.0 MEDIUM 8.0 HIGH
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global `config.xml` file.
CVE-2021-21695 1 Jenkins 1 Jenkins 2022-10-24 6.8 MEDIUM 8.8 HIGH
FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
CVE-2021-21689 1 Jenkins 1 Jenkins 2022-10-24 6.4 MEDIUM 9.1 CRITICAL
FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
CVE-2022-43406 1 Jenkins 1 Groovy Libraries 2022-10-24 N/A 9.9 CRITICAL
A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVE-2022-43435 1 Jenkins 1 360 Fireline 2022-10-24 N/A 5.3 MEDIUM
Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
CVE-2022-43434 1 Jenkins 1 Neuvector Vulnerability Scanner 2022-10-24 N/A 5.3 MEDIUM
Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
CVE-2022-43433 1 Jenkins 1 Screenrecorder 2022-10-23 N/A 4.3 MEDIUM
Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
CVE-2022-43432 1 Jenkins 1 Xframium Builder 2022-10-23 N/A 4.3 MEDIUM
Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
CVE-2022-43426 1 Jenkins 1 S3 Explorer 2022-10-22 N/A 5.3 MEDIUM
Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture it.
CVE-2022-43431 1 Jenkins 1 Compuware Strobe Measurement 2022-10-22 N/A 4.3 MEDIUM
Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-43429 1 Jenkins 2 Compuware Topaz For Total Test, Jenkins 2022-10-22 N/A 7.5 HIGH
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.
CVE-2022-43428 1 Jenkins 2 Compuware Topax For Total Test, Jenkins 2022-10-22 N/A 5.3 MEDIUM
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.
CVE-2022-43430 1 Jenkins 1 Compuware Topaz For Total Test 2022-10-22 N/A 7.5 HIGH
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-43427 1 Jenkins 1 Compuware Topaz For Total Test 2022-10-22 N/A 4.3 MEDIUM
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-43424 1 Jenkins 2 Compuware Xpediter Code, Jenkins 2022-10-22 N/A 5.3 MEDIUM
Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.