Filtered by vendor Jenkins
Subscribe
Total
1744 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-24456 | 1 Jenkins | 1 Keycloak Authentication | 2025-04-02 | N/A | 9.8 CRITICAL |
|
Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.
|
|||||
| CVE-2023-24455 | 1 Jenkins | 1 Visual Expert | 2025-04-02 | N/A | 4.3 MEDIUM |
|
Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configure permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
|
|||||
| CVE-2023-24454 | 1 Jenkins | 1 Testquality Updater | 2025-04-02 | N/A | 5.5 MEDIUM |
|
Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
|
|||||
| CVE-2023-24453 | 1 Jenkins | 1 Testquality Updater | 2025-04-02 | N/A | 6.5 MEDIUM |
|
A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
|
|||||
| CVE-2023-24452 | 1 Jenkins | 1 Testquality Updater | 2025-04-02 | N/A | 8.8 HIGH |
|
A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.
|
|||||
| CVE-2023-24450 | 1 Jenkins | 1 View-cloner | 2025-04-02 | N/A | 6.5 MEDIUM |
|
Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
|
|||||
| CVE-2023-24449 | 1 Jenkins | 1 Pwauth Security Realm | 2025-04-02 | N/A | 4.3 MEDIUM |
|
Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
|
|||||
| CVE-2023-24448 | 1 Jenkins | 1 Rabbitmq Consumer | 2025-04-02 | N/A | 6.5 MEDIUM |
|
A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
|
|||||
| CVE-2023-24447 | 1 Jenkins | 1 Rabbitmq Consumer | 2025-04-02 | N/A | 8.8 HIGH |
|
A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
|
|||||
| CVE-2023-24446 | 1 Jenkins | 1 Openid | 2025-04-02 | N/A | 8.8 HIGH |
|
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account.
|
|||||
| CVE-2023-24445 | 1 Jenkins | 1 Openid | 2025-04-02 | N/A | 6.1 MEDIUM |
|
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
|
|||||
| CVE-2023-24444 | 1 Jenkins | 1 Openid | 2025-04-02 | N/A | 9.8 CRITICAL |
|
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
|
|||||
| CVE-2023-24443 | 1 Jenkins | 1 Testcomplete Support | 2025-04-02 | N/A | 9.8 CRITICAL |
|
Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
|
|||||
| CVE-2023-24442 | 1 Jenkins | 1 Github Pull Request Coverage Status | 2025-04-02 | N/A | 5.5 MEDIUM |
|
Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
|
|||||
| CVE-2023-24441 | 1 Jenkins | 1 Mstest | 2025-04-02 | N/A | 9.8 CRITICAL |
|
Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
|
|||||
| CVE-2023-24440 | 1 Jenkins | 1 Jira Pipeline Steps | 2025-04-02 | N/A | 5.5 MEDIUM |
|
Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
|
|||||
| CVE-2023-24439 | 1 Jenkins | 1 Jira Pipeline Steps | 2025-04-02 | N/A | 5.5 MEDIUM |
|
Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
|
|||||
| CVE-2023-24438 | 1 Jenkins | 1 Jira Pipeline Steps | 2025-04-02 | N/A | 6.5 MEDIUM |
|
A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
|
|||||
| CVE-2023-24437 | 1 Jenkins | 1 Jira Pipeline Steps | 2025-04-02 | N/A | 8.8 HIGH |
|
A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
|
|||||
| CVE-2023-24436 | 1 Jenkins | 1 Github Pull Request Builder | 2025-04-02 | N/A | 4.3 MEDIUM |
|
A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
|
|||||
| CVE-2023-24435 | 1 Jenkins | 1 Github Pull Request Builder | 2025-04-02 | N/A | 6.5 MEDIUM |
|
A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
|
|||||
| CVE-2023-24434 | 1 Jenkins | 1 Github Pull Request Builder | 2025-04-02 | N/A | 8.8 HIGH |
|
A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
|
|||||
| CVE-2023-24433 | 1 Jenkins | 1 Orka By Macstadium | 2025-04-02 | N/A | 6.5 MEDIUM |
|
Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
|
|||||
| CVE-2023-24426 | 1 Jenkins | 1 Azure Ad | 2025-04-02 | N/A | 8.8 HIGH |
|
Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.
|
|||||
| CVE-2023-24459 | 1 Jenkins | 1 Bearychat | 2025-04-01 | N/A | 6.5 MEDIUM |
|
A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
|
|||||
| CVE-2024-28155 | 1 Jenkins | 1 Appspider | 2025-03-29 | N/A | 4.3 MEDIUM |
|
Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about available scan config names, engine group names, and client names.
|
|||||
| CVE-2024-28156 | 1 Jenkins | 1 Build Monitor View | 2025-03-27 | N/A | 5.4 MEDIUM |
|
Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure Build Monitor Views.
|
|||||
| CVE-2024-28154 | 1 Jenkins | 1 Mq Notifier | 2025-03-27 | N/A | 6.5 MEDIUM |
|
Jenkins MQ Notifier Plugin 1.4.0 and earlier logs potentially sensitive build parameters as part of debug information in build logs by default.
|
|||||
| CVE-2024-43045 | 1 Jenkins | 1 Jenkins | 2025-03-25 | N/A | 6.3 MEDIUM |
|
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".
|
|||||
| CVE-2024-28153 | 1 Jenkins | 1 Owasp Dependency-check | 2025-03-25 | N/A | 5.4 MEDIUM |
|
Jenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in a stored cross-site scripting (XSS) vulnerability.
|
|||||
| CVE-2023-25763 | 1 Jenkins | 1 Email Extension | 2025-03-19 | N/A | 5.4 MEDIUM |
|
Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control affected fields.
|
|||||
| CVE-2023-25762 | 1 Jenkins | 1 Pipeline\ | 2025-03-19 | N/A | 5.4 MEDIUM |
|
Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.
|
|||||
| CVE-2024-47803 | 1 Jenkins | 1 Jenkins | 2025-03-19 | N/A | 4.3 MEDIUM |
|
Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form field.
|
|||||
| CVE-2023-25768 | 1 Jenkins | 1 Azure Credentials | 2025-03-19 | N/A | 6.5 MEDIUM |
|
A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server.
|
|||||
| CVE-2023-25767 | 1 Jenkins | 1 Azure Credentials | 2025-03-19 | N/A | 8.8 HIGH |
|
A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-specified web server.
|
|||||
| CVE-2023-25766 | 1 Jenkins | 1 Azure Credentials | 2025-03-19 | N/A | 4.3 MEDIUM |
|
A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
|
|||||
| CVE-2023-25765 | 1 Jenkins | 1 Email Extension | 2025-03-19 | N/A | 9.9 CRITICAL |
|
In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
|
|||||
| CVE-2023-25764 | 1 Jenkins | 1 Email Extension | 2025-03-19 | N/A | 5.4 MEDIUM |
|
Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or change custom email templates.
|
|||||
| CVE-2023-25761 | 1 Jenkins | 1 Junit | 2025-03-19 | N/A | 5.4 MEDIUM |
|
Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.
|
|||||
| CVE-2023-23847 | 1 Jenkins | 1 Synopsys Coverity | 2025-03-19 | N/A | 3.5 LOW |
|
A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
|
|||||