Jenkins Project vulnerabilities, page 2
1,518 vulnerabilities
Known vulnerabilities in Jenkins Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 696 products.
CVE-2021-21652jenkins projectjenkins xray - test management for jira plugin+2
EPSS score0.64%
A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.CVE-2021-21602jenkins projectjenkins+2EPSS score2.25%
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.CVE-2021-21632jenkins projectjenkins owasp dependency-track plugin+2EPSS score1.05%
A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins.CVE-2021-21646jenkins projectjenkins templating engine plugin+2EPSS score1.75%
Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.CVE-2021-21622jenkins projectjenkins artifact repository parameter plugin+2EPSS score9.39%
Jenkins Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.CVE-2021-21685jenkins projectjenkins+2EPSS score1.56%
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs.CVE-2021-21689jenkins projectjenkins+2EPSS score1.50%
FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.CVE-2021-21639jenkins projectjenkins+2EPSS score2.73%
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one of a different type.CVE-2021-21611jenkins projectjenkins+2EPSS score1.04%
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.CVE-2021-21690jenkins projectjenkins+2EPSS score2.53%
Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.CVE-2021-21641jenkins projectjenkins promoted builds plugin+2EPSS score1.16%
A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds.CVE-2021-21700jenkins projectjenkins scriptler plugin+2EPSS score0.71%
Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by exploitable by attackers able to create Scriptler scripts.CVE-2021-21677jenkins projectjenkins code coverage api plugin+2EPSS score2.21%
Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulting in a remote code execution vulnerability.CVE-2021-21617jenkins projectjenkins configuration slicing plugin+2EPSS score0.94%
A cross-site request forgery (CSRF) vulnerability in Jenkins Configuration Slicing Plugin 1.51 and earlier allows attackers to apply different slice configurations.CVE-2021-21631jenkins projectjenkins cloud statistics plugin+2EPSS score0.80%
Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages.CVE-2021-21655jenkins projectjenkins p4 plugin+2EPSS score0.52%
A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password.CVE-2021-21657jenkins projectjenkins filesystem trigger plugin+2EPSS score1.60%
Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2021-21607jenkins projectjenkins+2EPSS score1.46%
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors.CVE-2021-21696jenkins projectjenkins+2EPSS score2.40%
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library with a modified variant. This results in unsandboxed code execution in the Jenkins controller process.CVE-2021-21656jenkins projectjenkins xcode integration plugin+2EPSS score1.51%
Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.