Jenkins vulnerabilities
1,729 vulnerabilities
Known vulnerabilities in Jenkins products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 703 products.
Products
50 of 703- Jenkins281 vulnerabilities
- Script Security45 vulnerabilities
- Active Directory12 vulnerabilities
- Blue Ocean11 vulnerabilities
- Email Extension11 vulnerabilities
- Git11 vulnerabilities
- Build Failure Analyzer9 vulnerabilities
- Config File Provider9 vulnerabilities
- Configuration As Code9 vulnerabilities
- Credentials Binding8 vulnerabilities
- Github Branch Source8 vulnerabilities
- Ns Nd Integration Performance Publisher8 vulnerabilities
- Html Publisher7 vulnerabilities
- Job Configuration History7 vulnerabilities
- Kubernetes7 vulnerabilities
- Openid Connect Authentication7 vulnerabilities
- Openshift Deployer7 vulnerabilities
- Rundeck7 vulnerabilities
- Subversion7 vulnerabilities
- Amazon Ec26 vulnerabilities
- Azure Ad6 vulnerabilities
- Azure Vm Agents6 vulnerabilities
- Deployment Dashboard6 vulnerabilities
- Electricflow6 vulnerabilities
- Gerrit Trigger6 vulnerabilities
- Git Client6 vulnerabilities
- Git Parameter6 vulnerabilities
- Github6 vulnerabilities
- Github Pull Request Builder6 vulnerabilities
- Gitlab6 vulnerabilities
- Google Compute Engine6 vulnerabilities
- Hashicorp Vault6 vulnerabilities
- Pipeline Maven Integration6 vulnerabilities
- Project Inheritance6 vulnerabilities
- Repository Connector6 vulnerabilities
- Saml Single Sign On6 vulnerabilities
- Warnings Next Generation6 vulnerabilities
- Xebialabs Xl Deploy6 vulnerabilities
- Active Choices5 vulnerabilities
- Appspider5 vulnerabilities
- Assembla5 vulnerabilities
- Aws Codecommit Trigger5 vulnerabilities
- Cadence Vmanager5 vulnerabilities
- Code Dx5 vulnerabilities
- Delphix5 vulnerabilities
- Extended Choice Parameter5 vulnerabilities
- Fortify5 vulnerabilities
- Google Login5 vulnerabilities
- Jenkins Code Dx Plugin5 vulnerabilities
- Jira5 vulnerabilities
CVE-2018-1999040jenkinskubernetes+1
EPSS score1.40%
An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.CVE-2018-1999036jenkinsssh_agent+1EPSS score1.37%
An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH private key password to users with permission to read the build log.CVE-2018-1999025jenkinstracetronic_ecu-test+1EPSS score0.86%
A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java that allows attackers to impersonate any service that Jenkins connects to.CVE-2018-1999043jenkinsjenkins+1EPSS score1.67%
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.java that allows attackers to create ephemeral in-memory user records by attempting to log in using invalid credentials.CVE-2018-1999002jenkinsjenkins+2EPSS score86.46%
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.CVE-2018-1999004jenkinsjenkins+2EPSS score0.94%
A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches.CVE-2018-1999029jenkinsshelve_project+1EPSS score0.72%
A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.CVE-2018-1999001jenkinsjenkins+2EPSS score18.12%
A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allows attackers to provide crafted login credentials that cause Jenkins to move the config.xml file from the Jenkins home directory. If Jenkins is started without this file present, it will revert to the legacy defaults of granting administrator access to anonymous users.CVE-2018-1999031jenkinsmeliora_testlab+1EPSS score0.93%
An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that allows attackers with file system access to the Jenkins master to obtain the API key stored in this plugin's configuration.CVE-2018-1999005jenkinsjenkins+2EPSS score0.89%
A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidget/control.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.CVE-2018-1999007jenkinsjenkins+3EPSS score0.89%
A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins to define JavaScript that would be executed in another user's browser when that other user views HTTP 404 error pages while Stapler debug mode is enabled.CVE-2018-1999042jenkinsjenkins+1EPSS score1.46%
A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.CVE-2018-1999046jenkinsjenkins+1EPSS score1.25%
A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attackers With Overall/Read permission to access the connection log for any agent.CVE-2018-1999044jenkinsjenkins+1EPSS score1.17%
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.CVE-2018-1999035jenkinsinedo_buildmaster+1EPSS score0.86%
A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMasterApi.java that allows attackers to impersonate any service that Jenkins connects to.CVE-2018-1999026jenkinstracetronic_ecu-test+1EPSS score0.85%
A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Jenkins send HTTP requests to an attacker-specified host.CVE-2018-1999030jenkinsmaven_artifact_choicelistprovider_\(nexus\)+1EPSS score0.68%
An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, Nexus3ChoiceListProvider.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.CVE-2018-1999038jenkinspublish_over_cifs+1EPSS score0.48%
A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials.CVE-2018-1999034jenkinsinedo_proget+1EPSS score0.79%
A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that allows attackers to impersonate any service that Jenkins connects to.CVE-2018-1999045jenkinsjenkins+1EPSS score0.87%
A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled.