Vendor
Jenkins Project
1,625 known vulnerabilities.
Products
Jenkins 156
Jenkins Script Security Plugin 39
Jenkins Active Directory Plugin 11
Jenkins Pipeline: Groovy Plugin 11
Jenkins Email Extension Plugin 9
Jenkins Pipeline: Shared Groovy Libraries Plugin 8
Jenkins Job Configuration History Plugin 8
Jenkins Build Failure Analyzer Plugin 8
Jenkins NS-ND Integration Performance Publisher Plugin 8
Jenkins OpenId Connect Authentication Plugin 8
Jenkins GitLab Plugin 8
Jenkins Git Plugin 7
Jenkins Rundeck Plugin 7
Jenkins Configuration as Code Plugin 7
Jenkins Amazon EC2 Plugin 7
Jenkins OpenShift Deployer Plugin 7
Jenkins XebiaLabs XL Deploy Plugin 7
Jenkins SAML Single Sign On(SSO) Plugin 7
Jenkins HashiCorp Vault Plugin 6
Jenkins ElectricFlow Plugin 6
Jenkins Deployment Dashboard Plugin 6
Jenkins Credentials Binding Plugin 6
Jenkins Artifactory Plugin 6
Jenkins Git Parameter Plugin 6
Jenkins Repository Connector Plugin 6
Jenkins Project Inheritance Plugin 6
Jenkins Azure VM Agents Plugin 6
Jenkins HTML Publisher Plugin 6
Jenkins Pipeline Maven Integration Plugin 6
Jenkins Config File Provider Plugin 6
Jenkins Gitlab Authentication Plugin 6
Jenkins WSO2 Oauth Plugin 5
Jenkins Blue Ocean Plugin 5
Jenkins Code Dx Plugin 5
Jenkins Subversion Plugin 5
Jenkins OctoPerf Load Testing Plugin Plugin 5
Jenkins Job Import Plugin 5
Jenkins Extended Choice Parameter Plugin 5
Jenkins Publish Over SSH Plugin 5
Jenkins Delphix Plugin 5
995 results · Clear filters · Feed
-
Medium 4.3
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the fi…
-
Medium 4.3
A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read per…
-
Medium 5.4
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar ove…
-
Medium 6.1
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpRespon…
-
Medium 6.1
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace bro…
-
Medium 6.5
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being r…
-
Medium 5.4
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, a…
-
Medium 6.8
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in…
-
Medium 4.3
Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attac…
-
Medium 6.5
Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, includi…
-
Medium 4.2
The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_call…
-
Medium 5.4
Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API t…
-
Medium 5.4
Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected …
-
Medium 4.2
Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to…
-
Medium 5.4
Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and versi…
-
Medium 4.3
Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the …
-
Medium 5.4
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read pe…
-
Medium 5.4
Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recor…
-
Medium 5.4
Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler …
-
Medium 5.4
A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and ea…
-
Medium 5.4
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream bu…
-
Medium 4.3
Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data bindin…
-
Medium 5.4
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream bu…
-
Medium 4.3
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that c…
-
Medium 4.3
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constru…
-
Medium 4.2
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission …
-
Medium 4.3
A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permis…
-
Medium 4.3
Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python…
-
Medium 5.4
In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS…
-
Medium 6.3
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration …
-
Medium 4.3
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserial…
-
Medium 4.3
Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission…
-
Medium 4.3
Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permissi…
-
Medium 4.3
Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to…
-
Medium 4.3
A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Over…
-
Medium 4.3
Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credent…
-
Medium 4.3
Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials look…
-
Medium 5.4
Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pa…
-
Medium 5.4
Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in …
-
Medium 6.5
Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking app…