Filtered by vendor Jenkins
Subscriptions
Total
1612 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-30517 | 1 Jenkins | 1 Neuvector Vulnerability Scanner | 2024-08-02 | 5.3 Medium |
| Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server. | ||||
| CVE-2023-30524 | 1 Jenkins | 1 Report Portal | 2024-08-02 | 4.3 Medium |
| Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and capture them. | ||||
| CVE-2023-30529 | 1 Jenkins | 1 Lucene-search | 2024-08-02 | 4.3 Medium |
| Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database. | ||||
| CVE-2023-30513 | 1 Jenkins | 1 Kubernetes | 2024-08-02 | 7.5 High |
| Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled. | ||||
| CVE-2023-30516 | 1 Jenkins | 1 Image Tag Parameter | 2024-08-02 | 6.5 Medium |
| Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resulting in job configurations using Image Tag Parameters that were created before 2.0 having SSL/TLS certificate validation disabled by default. | ||||
| CVE-2023-28668 | 1 Jenkins | 1 Role-based Authorization Strategy | 2024-08-02 | 9.8 Critical |
| Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled. | ||||
| CVE-2023-28674 | 1 Jenkins | 1 Octoperf Load Testing | 2024-08-02 | 8.8 High |
| A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials. | ||||
| CVE-2023-28671 | 1 Jenkins | 1 Octoperf Load Testing | 2024-08-02 | 4.3 Medium |
| A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | ||||
| CVE-2023-28677 | 1 Jenkins | 1 Convert To Pipeline | 2024-08-02 | 9.8 Critical |
| Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a convertion by Jenkins Convert To Pipeline Plugin. | ||||
| CVE-2023-28678 | 1 Jenkins | 1 Cppcheck | 2024-08-02 | 5.4 Medium |
| Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control report file contents. | ||||
| CVE-2023-28675 | 1 Jenkins | 1 Octoperf Load Testing | 2024-08-02 | 4.3 Medium |
| A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials. | ||||
| CVE-2023-28680 | 1 Jenkins | 1 Crap4j | 2024-08-02 | 7.5 High |
| Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | ||||
| CVE-2023-28685 | 1 Jenkins | 1 Absint A3 | 2024-08-02 | 7.1 High |
| Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | ||||
| CVE-2023-28682 | 1 Jenkins | 1 Performance Publisher | 2024-08-02 | 8.2 High |
| Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | ||||
| CVE-2023-28679 | 1 Jenkins | 1 Mashup Portlets | 2024-08-02 | 5.4 Medium |
| Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expression, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission. | ||||
| CVE-2023-28684 | 1 Jenkins | 1 Remote-jobs-view | 2024-08-02 | 6.5 Medium |
| Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | ||||
| CVE-2023-28683 | 1 Jenkins | 1 Phabricator Differential | 2024-08-02 | 8.2 High |
| Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | ||||
| CVE-2023-28670 | 1 Jenkins | 1 Pipeline Aggregator View | 2024-08-02 | 5.4 Medium |
| Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission. | ||||
| CVE-2023-28669 | 1 Jenkins | 1 Jacoco | 2024-08-02 | 5.4 Medium |
| Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action. | ||||
| CVE-2023-28676 | 1 Jenkins | 1 Convert To Pipeline | 2024-08-02 | 8.8 High |
| A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freestyle project, potentially leading to remote code execution (RCE). | ||||