Filtered by vendor Jenkins
Subscribe
Search
Total
807 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-2304 | 1 Jenkins | 1 Subversion | 2020-11-10 | 4.0 MEDIUM | 6.5 MEDIUM |
| Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | |||||
| CVE-2020-2316 | 1 Jenkins | 1 Static Analysis Utilities | 2020-11-10 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. | |||||
| CVE-2020-2305 | 1 Jenkins | 1 Mercurial | 2020-11-10 | 4.0 MEDIUM | 6.5 MEDIUM |
| Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | |||||
| CVE-2020-2317 | 1 Jenkins | 1 Findbugs | 2020-11-10 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to Jenkins FindBugs Plugin's post build step. | |||||
| CVE-2020-2307 | 1 Jenkins | 1 Kubernetes | 2020-11-09 | 4.0 MEDIUM | 4.3 MEDIUM |
| Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables. | |||||
| CVE-2020-2306 | 1 Jenkins | 1 Mercurial | 2020-11-06 | 4.0 MEDIUM | 4.3 MEDIUM |
| A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations. | |||||
| CVE-2020-2309 | 1 Jenkins | 1 Kubernetes | 2020-11-06 | 4.0 MEDIUM | 4.3 MEDIUM |
| A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||||
| CVE-2020-2308 | 1 Jenkins | 1 Kubernetes | 2020-11-06 | 4.0 MEDIUM | 4.3 MEDIUM |
| A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names. | |||||
| CVE-2020-2303 | 1 Jenkins | 1 Active Directory | 2020-11-06 | 4.3 MEDIUM | 4.3 MEDIUM |
| A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials. | |||||
| CVE-2020-2313 | 1 Jenkins | 1 Azure Key Vault | 2020-11-06 | 4.0 MEDIUM | 4.3 MEDIUM |
| A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||||
| CVE-2020-2311 | 1 Jenkins | 1 Aws Global Configuration | 2020-11-06 | 4.0 MEDIUM | 4.3 MEDIUM |
| A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration. | |||||
| CVE-2020-2302 | 1 Jenkins | 1 Active Directory | 2020-11-06 | 4.0 MEDIUM | 4.3 MEDIUM |
| A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page. | |||||
| CVE-2020-2298 | 1 Jenkins | 1 Nerrvana | 2020-10-16 | 4.0 MEDIUM | 6.5 MEDIUM |
| Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | |||||
| CVE-2020-2287 | 1 Jenkins | 1 Audit Trail | 2020-10-16 | 5.0 MEDIUM | 5.3 MEDIUM |
| Jenkins Audit Trail Plugin 3.6 and earlier applies pattern matching to a different representation of request URL paths than the Stapler web framework uses for dispatching requests, which allows attackers to craft URLs that bypass request logging of any target URL. | |||||
| CVE-2020-2292 | 1 Jenkins | 1 Release | 2020-10-15 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Release/Release permission. | |||||
| CVE-2020-2293 | 1 Jenkins | 1 Persona | 2020-10-09 | 4.0 MEDIUM | 6.5 MEDIUM |
| Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller. | |||||
| CVE-2020-2290 | 1 Jenkins | 1 Active Choices | 2020-10-09 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. | |||||
| CVE-2020-2289 | 1 Jenkins | 1 Active Choices | 2020-10-09 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. | |||||
| CVE-2020-2288 | 1 Jenkins | 1 Audit Trail | 2020-10-09 | 5.0 MEDIUM | 5.3 MEDIUM |
| In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to the URL that would be ignored during request handling. | |||||
| CVE-2020-2296 | 1 Jenkins | 1 Shared Objects | 2020-10-09 | 4.3 MEDIUM | 4.3 MEDIUM |
| A cross-site request forgery (CSRF) vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared objects. | |||||
| CVE-2019-16547 | 1 Jenkins | 1 Google Compute Engine | 2020-10-09 | 4.0 MEDIUM | 4.3 MEDIUM |
| Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment. | |||||
| CVE-2019-16566 | 1 Jenkins | 1 Team Concert | 2020-10-05 | 4.0 MEDIUM | 6.5 MEDIUM |
| A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |||||
| CVE-2019-16567 | 1 Jenkins | 1 Team Concert | 2020-10-05 | 4.0 MEDIUM | 4.3 MEDIUM |
| A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. | |||||
| CVE-2019-16571 | 1 Jenkins | 1 Rapiddeploy | 2020-10-05 | 4.0 MEDIUM | 4.3 MEDIUM |
| A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server. | |||||
| CVE-2019-16574 | 1 Jenkins | 1 Alauda Devops Pipeline | 2020-10-05 | 4.0 MEDIUM | 6.5 MEDIUM |
| A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |||||
| CVE-2019-16576 | 1 Jenkins | 1 Alauda Kubernetes Support | 2020-10-05 | 4.0 MEDIUM | 6.5 MEDIUM |
| A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins. | |||||
| CVE-2019-10290 | 1 Jenkins | 1 Netsparker Cloud Scan | 2020-10-02 | 4.0 MEDIUM | 6.5 MEDIUM |
| A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method allowed attackers with Overall/Read permission to initiate a connection to an attacker-specified server. | |||||
| CVE-2019-10308 | 1 Jenkins | 1 Static Analysis Utilities | 2020-10-02 | 4.0 MEDIUM | 6.5 MEDIUM |
| A missing permission check in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers with Overall/Read permission to change the per-job default graph configuration for all users. | |||||
| CVE-2019-10305 | 1 Jenkins | 1 Xebialabs Xl Deploy | 2020-10-02 | 4.0 MEDIUM | 6.5 MEDIUM |
| A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server. | |||||
| CVE-2019-10319 | 1 Jenkins | 1 Pluggable Authentication Module | 2020-10-02 | 4.0 MEDIUM | 4.3 MEDIUM |
| A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allowed users with Overall/Read permission to obtain limited information about the file /etc/shadow and the user Jenkins is running as. | |||||
| CVE-2019-10333 | 1 Jenkins | 1 Electricflow | 2020-10-02 | 4.0 MEDIUM | 4.3 MEDIUM |
| Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access to obtain information about the Jenkins ElectricFlow Plugin configuration and configuration of connected ElectricFlow instances. | |||||
| CVE-2019-10354 | 2 Jenkins, Redhat | 2 Jenkins, Openshift Container Platform | 2020-10-02 | 4.0 MEDIUM | 4.3 MEDIUM |
| A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information. | |||||
| CVE-2019-10345 | 1 Jenkins | 1 Configuration As Code | 2020-10-02 | 2.1 LOW | 5.5 MEDIUM |
| Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export. | |||||
| CVE-2019-10344 | 1 Jenkins | 1 Configuration As Code | 2020-10-02 | 4.0 MEDIUM | 4.3 MEDIUM |
| Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins. | |||||
| CVE-2019-10361 | 1 Jenkins | 1 M2release | 2020-10-02 | 2.1 LOW | 5.5 MEDIUM |
| Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the master file system. | |||||
| CVE-2019-10357 | 2 Jenkins, Redhat | 2 Pipeline\, Openshift Container Platform | 2020-10-02 | 4.0 MEDIUM | 4.3 MEDIUM |
| A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries. | |||||
| CVE-2019-10364 | 1 Jenkins | 1 Ec2 | 2020-10-02 | 2.1 LOW | 5.5 MEDIUM |
| Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log. | |||||
| CVE-2019-10363 | 1 Jenkins | 1 Configuration As Code | 2020-10-02 | 4.0 MEDIUM | 4.9 MEDIUM |
| Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form. | |||||
| CVE-2019-10391 | 1 Jenkins | 1 Ibm Application Security On Cloud | 2020-10-02 | 4.3 MEDIUM | 6.5 MEDIUM |
| Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure. | |||||
| CVE-2019-10387 | 1 Jenkins | 1 Xl Testview | 2020-10-02 | 4.0 MEDIUM | 6.5 MEDIUM |
| A missing permission check in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |||||
| CVE-2019-10375 | 1 Jenkins | 1 File System Scm | 2020-10-02 | 4.0 MEDIUM | 6.5 MEDIUM |
| An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins to obtain the contents of any file on the Jenkins master. | |||||
| CVE-2019-10370 | 1 Jenkins | 1 Mask Passwords | 2020-10-02 | 4.3 MEDIUM | 6.5 MEDIUM |
| Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting in their exposure. | |||||
| CVE-2019-10436 | 1 Jenkins | 1 Google Oauth Credentials | 2020-10-01 | 4.0 MEDIUM | 6.5 MEDIUM |
| An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master. | |||||
| CVE-2019-10312 | 1 Jenkins | 1 Ansible Tower | 2020-10-01 | 4.0 MEDIUM | 4.3 MEDIUM |
| A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillTowerCredentialsIdItems method allowed attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins. | |||||
| CVE-2019-10377 | 1 Jenkins | 1 Avatar | 2020-10-01 | 4.0 MEDIUM | 4.3 MEDIUM |
| A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins. | |||||
| CVE-2019-10341 | 1 Jenkins | 1 Docker | 2020-10-01 | 4.0 MEDIUM | 6.5 MEDIUM |
| A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |||||
| CVE-2019-10332 | 1 Jenkins | 1 Electricflow | 2020-10-01 | 4.3 MEDIUM | 4.3 MEDIUM |
| A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials. | |||||
| CVE-2019-10342 | 1 Jenkins | 1 Docker | 2020-10-01 | 4.0 MEDIUM | 4.3 MEDIUM |
| A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. | |||||
| CVE-2019-10279 | 1 Jenkins | 1 Jenkins-reviewbot | 2020-10-01 | 4.0 MEDIUM | 6.5 MEDIUM |
| A missing permission check in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server. | |||||
| CVE-2019-10293 | 1 Jenkins | 1 Kmap | 2020-10-01 | 4.0 MEDIUM | 6.5 MEDIUM |
| A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server. | |||||