Jenkins Project vulnerabilities
1,518 vulnerabilities
Known vulnerabilities in Jenkins Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 696 products.
Products
48 of 696- Jenkins74 vulnerabilities
- Jenkins Script Security Plugin39 vulnerabilities
- Jenkins Active Directory Plugin11 vulnerabilities
- Jenkins Build Failure Analyzer Plugin8 vulnerabilities
- Jenkins Gitlab Plugin8 vulnerabilities
- Jenkins Job Configuration History Plugin8 vulnerabilities
- Jenkins NS ND Integration Performance Publisher Plugin8 vulnerabilities
- Jenkins Amazon EC2 Plugin7 vulnerabilities
- Jenkins Configuration As Code Plugin7 vulnerabilities
- Jenkins Email Extension Plugin7 vulnerabilities
- Jenkins Git Plugin7 vulnerabilities
- Jenkins Openid Connect Authentication Plugin7 vulnerabilities
- Jenkins Openshift Deployer Plugin7 vulnerabilities
- Jenkins Rundeck Plugin7 vulnerabilities
- Jenkins SAML Single Sign On(Sso) Plugin7 vulnerabilities
- Jenkins Xebialabs XL Deploy Plugin7 vulnerabilities
- Jenkins Artifactory Plugin6 vulnerabilities
- Jenkins Azure VM Agents Plugin6 vulnerabilities
- Jenkins Credentials Binding Plugin6 vulnerabilities
- Jenkins Deployment Dashboard Plugin6 vulnerabilities
- Jenkins Electricflow Plugin6 vulnerabilities
- Jenkins Git Parameter Plugin6 vulnerabilities
- Jenkins Gitlab Authentication Plugin6 vulnerabilities
- Jenkins Hashicorp Vault Plugin6 vulnerabilities
- Jenkins HTML Publisher Plugin6 vulnerabilities
- Jenkins Pipeline Maven Integration Plugin6 vulnerabilities
- Jenkins Project Inheritance Plugin6 vulnerabilities
- Jenkins Repository Connector Plugin6 vulnerabilities
- Jenkins Appspider Plugin5 vulnerabilities
- Jenkins AWS Codecommit Trigger Plugin5 vulnerabilities
- Jenkins Cadence Vmanager Plugin5 vulnerabilities
- Jenkins Chef Sinatra Plugin5 vulnerabilities
- Jenkins Config File Provider Plugin5 vulnerabilities
- Jenkins Delphix Plugin5 vulnerabilities
- Jenkins Extended Choice Parameter Plugin5 vulnerabilities
- Jenkins Fortify Plugin5 vulnerabilities
- Jenkins Job Import Plugin5 vulnerabilities
- Jenkins Mabl Plugin5 vulnerabilities
- Jenkins Matrix Project Plugin5 vulnerabilities
- Jenkins Maven Release Plugin5 vulnerabilities
- Jenkins Neuvector Vulnerability Scanner Plugin5 vulnerabilities
- Jenkins Octoperf Load Testing Plugin Plugin5 vulnerabilities
- Jenkins Openid Plugin5 vulnerabilities
- Jenkins Publish Over SSH Plugin5 vulnerabilities
- Jenkins Scriptler Plugin5 vulnerabilities
- Jenkins Subversion Plugin5 vulnerabilities
- Jenkins Support Core Plugin5 vulnerabilities
- Jenkins Websphere Deployer Plugin5 vulnerabilities
CVE-2021-21626jenkins projectjenkins warnings next generation plugin+2
EPSS score0.86%
Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.CVE-2021-21623jenkins projectjenkins matrix authorization strategy plugin+2EPSS score1.01%
An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.CVE-2021-21608jenkins projectjenkins+2EPSS score1.04%
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels.CVE-2021-21698jenkins projectjenkins subversion plugin+2EPSS score2.14%
Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.CVE-2021-21645jenkins projectjenkins config file provider plugin+2EPSS score0.89%
Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.CVE-2021-21666jenkins projectjenkins kiuwan plugin+2EPSS score1.22%
Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.CVE-2021-21679jenkins projectjenkins azure ad plugin+2EPSS score0.68%
Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.CVE-2021-21662jenkins projectjenkins xebialabs xl deploy plugin+2EPSS score0.95%
A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.CVE-2021-21603jenkins projectjenkins+2EPSS score1.04%
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability.CVE-2021-21672jenkins projectjenkins selenium html report plugin+2EPSS score42.52%
Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2021-21609jenkins projectjenkins+2EPSS score1.32%
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission.CVE-2021-21686jenkins projectjenkins+2EPSS score1.98%
File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.CVE-2021-21688jenkins projectjenkins+2EPSS score1.41%
The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, FilePath#copyRecursiveTo).CVE-2021-21691jenkins projectjenkins+2EPSS score2.10%
Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.CVE-2021-21647jenkins projectjenkins cloudbees cd plugin+2EPSS score1.46%
Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedule builds of projects without having Item/Build permission.CVE-2021-21663jenkins projectjenkins xebialabs xl deploy plugin+2EPSS score1.00%
A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.CVE-2021-21620jenkins projectjenkins claim plugin+2EPSS score1.64%
A cross-site request forgery (CSRF) vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims.CVE-2021-21648jenkins projectjenkins credentials plugin+2EPSS score11.31%
Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.CVE-2021-21674jenkins projectjenkins requests-plugin plugin+2EPSS score0.97%
A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the list of pending requests.CVE-2021-21671jenkins projectjenkins+2EPSS score1.75%
Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.