Jenkins Project vulnerabilities, page 3
1,518 vulnerabilities
Known vulnerabilities in Jenkins Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 696 products.
CVE-2021-21630jenkins projectjenkins extra columns plugin+2
EPSS score72.39%
Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.CVE-2021-21616jenkins projectjenkins active choices plugin+2EPSS score76.22%
Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.CVE-2021-21628jenkins projectjenkins build with parameters plugin+2EPSS score81.43%
Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.CVE-2021-21676jenkins projectjenkins requests-plugin plugin+2EPSS score1.39%
Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to send test emails to an attacker-specified email address.CVE-2021-21643jenkins projectjenkins config file provider plugin+2EPSS score1.08%
Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.CVE-2021-21697jenkins projectjenkins+2EPSS score1.60%
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.CVE-2021-21669jenkins projectjenkins generic webhook trigger plugin+2EPSS score25.75%
Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2021-21614jenkins projectjenkins bumblebee hp alm plugin+2EPSS score0.34%
Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.CVE-2021-21604jenkins projectjenkins+2EPSS score1.70%
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator.CVE-2021-21665jenkins projectjenkins xebialabs xl deploy plugin+2EPSS score0.66%
A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.CVE-2021-21675jenkins projectjenkins requests-plugin plugin+2EPSS score1.26%
A cross-site request forgery (CSRF) vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests and/or have administrators apply pending requests.CVE-2021-21694jenkins projectjenkins+2EPSS score1.55%
FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.CVE-2021-21684jenkins projectjenkins git plugin+2EPSS score1.24%
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.CVE-2021-21659jenkins projectjenkins urltrigger plugin+2EPSS score66.77%
Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2021-21625jenkins projectjenkins cloudbees aws credentials plugin+2EPSS score0.75%
Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circumstances.CVE-2021-21644jenkins projectjenkins config file provider plugin+2EPSS score1.05%
A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.CVE-2021-21692jenkins projectjenkins+2EPSS score2.10%
FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission on the source path, instead of 'delete'.CVE-2021-21668jenkins projectjenkins scriptler plugin+2EPSS score76.02%
Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.CVE-2021-21613jenkins projectjenkins tics plugin+2EPSS score0.96%
Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.CVE-2021-21664jenkins projectjenkins xebialabs xl deploy plugin+2EPSS score0.99%
An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.