Jenkins Project vulnerabilities, page 4
1,518 vulnerabilities
Known vulnerabilities in Jenkins Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 696 products.
CVE-2021-21610jenkins projectjenkins+2
EPSS score1.20%
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.CVE-2021-21693jenkins projectjenkins+2EPSS score1.55%
When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.CVE-2021-21650jenkins projectjenkins s3 publisher plugin+2EPSS score0.71%
Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled.CVE-2021-21699jenkins projectjenkins active choices plugin+2EPSS score88.48%
Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.CVE-2021-21621jenkins projectjenkins support core plugin+2EPSS score1.21%
Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" information, which can include the session ID of the user creating the support bundle in some configurations.CVE-2021-21680jenkins projectjenkins nested view plugin+2EPSS score1.32%
Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks.CVE-2021-21658jenkins projectjenkins nuget plugin+2EPSS score1.54%
Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2021-21654jenkins projectjenkins p4 plugin+2EPSS score1.30%
Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.CVE-2021-21619jenkins projectjenkins claim plugin+2EPSS score9.39%
Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins.CVE-2021-21653jenkins projectjenkins xray - test management for jira plugin+2EPSS score0.86%
Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.CVE-2021-21673jenkins projectjenkins cas plugin+2EPSS score1.58%
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.CVE-2021-21612jenkins projectjenkins tracetronic ecu-test plugin+2EPSS score0.34%
Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.CVE-2021-21667jenkins projectjenkins scriptler plugin+2EPSS score75.74%
Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.CVE-2021-21661jenkins projectjenkins kubernetes cli plugin+2EPSS score1.64%
Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.CVE-2021-21618jenkins projectjenkins repository connector plugin+2EPSS score79.48%
Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.CVE-2021-21635jenkins projectjenkins rest list parameter plugin+2EPSS score8.76%
Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.CVE-2021-21687jenkins projectjenkins+2EPSS score1.43%
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.CVE-2021-21695jenkins projectjenkins+2EPSS score2.15%
FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.CVE-2021-21678jenkins projectjenkins saml plugin+2EPSS score0.81%
Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.CVE-2021-21627jenkins projectjenkins libvirt agents plugin+2EPSS score0.82%
A cross-site request forgery (CSRF) vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domains.