Vendor
Jenkins Project
1,625 known vulnerabilities.
Products
Jenkins 156
Jenkins Script Security Plugin 39
Jenkins Active Directory Plugin 11
Jenkins Pipeline: Groovy Plugin 11
Jenkins Email Extension Plugin 9
Jenkins Pipeline: Shared Groovy Libraries Plugin 8
Jenkins Job Configuration History Plugin 8
Jenkins Build Failure Analyzer Plugin 8
Jenkins NS-ND Integration Performance Publisher Plugin 8
Jenkins OpenId Connect Authentication Plugin 8
Jenkins GitLab Plugin 8
Jenkins Git Plugin 7
Jenkins Rundeck Plugin 7
Jenkins Configuration as Code Plugin 7
Jenkins Amazon EC2 Plugin 7
Jenkins OpenShift Deployer Plugin 7
Jenkins XebiaLabs XL Deploy Plugin 7
Jenkins SAML Single Sign On(SSO) Plugin 7
Jenkins HashiCorp Vault Plugin 6
Jenkins ElectricFlow Plugin 6
Jenkins Deployment Dashboard Plugin 6
Jenkins Credentials Binding Plugin 6
Jenkins Artifactory Plugin 6
Jenkins Git Parameter Plugin 6
Jenkins Repository Connector Plugin 6
Jenkins Project Inheritance Plugin 6
Jenkins Azure VM Agents Plugin 6
Jenkins HTML Publisher Plugin 6
Jenkins Pipeline Maven Integration Plugin 6
Jenkins Config File Provider Plugin 6
Jenkins Gitlab Authentication Plugin 6
Jenkins WSO2 Oauth Plugin 5
Jenkins Blue Ocean Plugin 5
Jenkins Code Dx Plugin 5
Jenkins Subversion Plugin 5
Jenkins OctoPerf Load Testing Plugin Plugin 5
Jenkins Job Import Plugin 5
Jenkins Extended Choice Parameter Plugin 5
Jenkins Publish Over SSH Plugin 5
Jenkins Delphix Plugin 5
444 results · Clear filters · Feed
-
High 8.8
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objec…
-
High 8.8
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in…
-
High 8.1
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, inclu…
-
High 8.1
In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not c…
-
High 8.1
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only befo…
-
High 8.8
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validati…
-
High 8.8
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into laun…
-
High 8.8
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by t…
-
High 8.8
Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framewo…
-
High 8.0
Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configura…
-
High 8.0
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the…
-
High 8.0
Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job conf…
-
High 7.5
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods…
-
High 7.5
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirmin…
-
High 8.0
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an ite…
-
High 7.2
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStra…
-
High 8.8
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass anno…
-
High 8.8
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the ele…
-
High 8.8
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy cre…
-
High 8.8
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null rece…
-
High 7.4
OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build e…
-
High 8.8
Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configur…
-
High 8.8
Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkin…
-
High 8.8
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions u…
-
High 8.8
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when…
-
High 8.8
A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission o…
-
High 8.8
Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file throu…
-
High 7.1
Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data b…
-
High 8.0
Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based…
-
High 7.3
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated…
-
High 8.8
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowi…
-
High 8.8
In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, include…
-
High 8.8
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (sourc…
-
High 8.8
In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS…
-
High 8.8
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in indepe…
-
High 7.1
Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attack…
-
High 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows att…
-
High 8.8
Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with S…
-
High 8.1
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsisten…
-
High 7.1
Jenkins Assembla Plugin has an XXE vulnerability
Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perfor…