Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (309499 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-21660 1 Jenkins 1 Markdown Formatter 2024-11-21 5.4 Medium
Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter.
CVE-2021-21659 1 Jenkins 1 Urltrigger 2024-11-21 8.1 High
Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21658 1 Jenkins 1 Nuget 2024-11-21 9.1 Critical
Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21657 1 Jenkins 1 Filesystem Trigger 2024-11-21 8.8 High
Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21656 1 Jenkins 1 Xcode Integration 2024-11-21 7.1 High
Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21655 1 Jenkins 1 P4 2024-11-21 7.1 High
A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password.
CVE-2021-21654 1 Jenkins 1 P4 2024-11-21 4.3 Medium
Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.
CVE-2021-21653 1 Jenkins 1 Xray - Test Management For Jira 2024-11-21 4.3 Medium
Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2021-21652 1 Jenkins 1 Xray - Test Management For Jira 2024-11-21 7.1 High
A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2021-21651 1 Jenkins 1 S3 Publisher 2024-11-21 4.3 Medium
Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain the list of configured profiles.
CVE-2021-21650 1 Jenkins 1 S3 Publisher 2024-11-21 4.3 Medium
Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled.
CVE-2021-21649 1 Jenkins 1 Dashboard View 2024-11-21 5.4 Medium
Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
CVE-2021-21648 2 Jenkins, Redhat 2 Credentials, Openshift 2024-11-21 6.1 Medium
Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVE-2021-21647 1 Jenkins 1 Cloudbees Cd 2024-11-21 4.3 Medium
Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedule builds of projects without having Item/Build permission.
CVE-2021-21646 1 Jenkins 1 Templating Engine 2024-11-21 8.8 High
Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
CVE-2021-21645 2 Jenkins, Redhat 3 Config File Provider, Openshift, Rhmt 2024-11-21 4.3 Medium
Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.
CVE-2021-21644 2 Jenkins, Redhat 3 Config File Provider, Openshift, Rhmt 2024-11-21 5.4 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.
CVE-2021-21643 2 Jenkins, Redhat 3 Config File Provider, Openshift, Rhmt 2024-11-21 6.5 Medium
Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.
CVE-2021-21642 2 Jenkins, Redhat 3 Config File Provider, Openshift, Rhmt 2024-11-21 8.1 High
Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21641 1 Jenkins 1 Promoted Builds 2024-11-21 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds.