CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Jenkins : Security Vulnerabilities (CVSS score between 1 and 4.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2022-34213 522 2022-06-23 2022-06-30
4.0
 None Remote Low ??? Partial None None
Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
2 CVE-2022-34212 862 2022-06-23 2022-06-29
3.5
 None Remote Medium ??? None Partial None
A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified URL.
3 CVE-2022-34211 352 CSRF 2022-06-23 2022-06-29
4.3
 None Remote Medium Not required None Partial None
A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an attacker-specified URL.
4 CVE-2022-34210 862 2022-06-23 2022-06-29
4.0
 None Remote Low ??? None Partial None
A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
5 CVE-2022-34209 352 CSRF 2022-06-23 2022-06-29
4.3
 None Remote Medium Not required None Partial None
A cross-site request forgery (CSRF) vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-specified URL.
6 CVE-2022-34208 862 2022-06-23 2022-06-30
4.0
 None Remote Low ??? None Partial None
A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
7 CVE-2022-34207 352 CSRF 2022-06-23 2022-06-29
4.3
 None Remote Medium Not required None Partial None
A cross-site request forgery (CSRF) vulnerability in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers to connect to an attacker-specified URL.
8 CVE-2022-34206 862 2022-06-23 2022-06-30
4.0
 None Remote Low ??? None Partial None
A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL.
9 CVE-2022-34205 352 CSRF 2022-06-23 2022-06-29
4.3
 None Remote Medium Not required None Partial None
A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an attacker-specified URL.
10 CVE-2022-34204 862 2022-06-23 2022-06-30
4.0
 None Remote Low ??? None Partial None
A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
11 CVE-2022-34202 256 2022-06-23 2022-06-29
4.0
 None Remote Low ??? Partial None None
Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
12 CVE-2022-34201 862 2022-06-23 2022-06-29
4.0
 None Remote Low ??? None Partial None
A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
13 CVE-2022-34200 352 CSRF 2022-06-23 2022-06-29
4.3
 None Remote Medium Not required None Partial None
A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect to an attacker-specified URL.
14 CVE-2022-34199 256 2022-06-23 2022-06-29
4.0
 None Remote Low ??? Partial None None
Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
15 CVE-2022-34198 79 XSS 2022-06-23 2022-06-29
3.5
 None Remote Medium ??? None Partial None
Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
16 CVE-2022-34197 79 XSS 2022-06-23 2022-06-29
3.5
 None Remote Medium ??? None Partial None
Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
17 CVE-2022-34196 79 XSS 2022-06-23 2022-06-29
3.5
 None Remote Medium ??? None Partial None
Jenkins REST List Parameter Plugin 1.5.2 and earlier does not escape the name and description of REST list parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
18 CVE-2022-34195 79 XSS 2022-06-23 2022-06-29
3.5
 None Remote Medium ??? None Partial None
Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
19 CVE-2022-34194 79 XSS 2022-06-23 2022-06-29
3.5
 None Remote Medium ??? None Partial None
Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
20 CVE-2022-34193 79 XSS 2022-06-23 2022-06-29
3.5
 None Remote Medium ??? None Partial None
Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
21 CVE-2022-34192 79 XSS 2022-06-23 2022-06-29
3.5
 None Remote Medium ??? None Partial None
Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, and Ontrack: SingleParameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
22 CVE-2022-34191 79 XSS 2022-06-23 2022-06-29
3.5
 None Remote Medium ??? None Partial None
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
23 CVE-2022-34190 79 XSS 2022-06-23 2022-06-29
3.5
 None Remote Medium ??? None Partial None
Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact versions parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
24 CVE-2022-34189 79 XSS 2022-06-23 2022-06-30
3.5
 None Remote Medium ??? None Partial None
Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
25 CVE-2022-34188 79 XSS 2022-06-23 2022-06-30
3.5
 None Remote Medium ??? None Partial None
Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
26 CVE-2022-34187 79 XSS 2022-06-23 2022-06-30
3.5
 None Remote Medium ??? None Partial None
Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
27 CVE-2022-34186 79 XSS 2022-06-23 2022-06-30
3.5
 None Remote Medium ??? None Partial None
Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
28 CVE-2022-34185 79 XSS 2022-06-23 2022-06-30
3.5
 None Remote Medium ??? None Partial None
Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
29 CVE-2022-34184 79 XSS 2022-06-23 2022-06-30
3.5
 None Remote Medium ??? None Partial None
Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
30 CVE-2022-34183 79 XSS 2022-06-23 2022-06-29
3.5
 None Remote Medium ??? None Partial None
Jenkins Agent Server Parameter Plugin 1.1 and earlier does not escape the name and description of Agent Server parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
31 CVE-2022-34182 79 XSS 2022-06-23 2022-06-29
4.3
 None Remote Medium Not required None Partial None
Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerability.
32 CVE-2022-34178 79 XSS 2022-06-23 2022-06-29
4.3
 None Remote Medium Not required None Partial None
Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting (XSS) vulnerability.
33 CVE-2022-34176 79 XSS 2022-06-23 2022-06-29
3.5
 None Remote Medium ??? None Partial None
Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.
34 CVE-2022-34173 79 XSS 2022-06-23 2022-06-30
4.3
 None Remote Medium Not required None Partial None
In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
35 CVE-2022-34172 79 XSS 2022-06-23 2022-06-30
4.3
 None Remote Medium Not required None Partial None
In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.
36 CVE-2022-34171 79 XSS 2022-06-23 2022-06-30
4.3
 None Remote Medium Not required None Partial None
In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.
37 CVE-2022-34170 79 XSS 2022-06-23 2022-06-30
4.3
 None Remote Medium Not required None Partial None
In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
38 CVE-2022-30970 79 XSS 2022-05-17 2022-05-25
3.5
 None Remote Medium ??? None Partial None
Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
39 CVE-2022-30968 79 XSS 2022-05-17 2022-05-25
3.5
 None Remote Medium ??? None Partial None
Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
40 CVE-2022-30967 79 XSS 2022-05-17 2022-05-25
3.5
 None Remote Medium ??? None Partial None
Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
41 CVE-2022-30966 79 XSS 2022-05-17 2022-05-25
3.5
 None Remote Medium ??? None Partial None
Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
42 CVE-2022-30965 79 XSS 2022-05-17 2022-05-25
3.5
 None Remote Medium ??? None Partial None
Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
43 CVE-2022-30964 79 XSS 2022-05-17 2022-05-25
3.5
 None Remote Medium ??? None Partial None
Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
44 CVE-2022-30963 79 XSS 2022-05-17 2022-05-25
3.5
 None Remote Medium ??? None Partial None
Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
45 CVE-2022-30962 79 XSS 2022-05-17 2022-05-25
3.5
 None Remote Medium ??? None Partial None
Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
46 CVE-2022-30961 79 XSS 2022-05-17 2022-05-25
3.5
 None Remote Medium ??? None Partial None
Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
47 CVE-2022-30960 79 XSS 2022-05-17 2022-05-25
3.5
 None Remote Medium ??? None Partial None
Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
48 CVE-2022-30959 862 2022-05-17 2022-05-25
4.0
 None Remote Low ??? Partial None None
A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
49 CVE-2022-30957 862 2022-05-17 2022-05-26
4.0
 None Remote Low ??? Partial None None
A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
50 CVE-2022-30956 79 XSS 2022-05-17 2022-05-26
3.5
 None Remote Medium ??? None Partial None
Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads.
Total number of vulnerabilities : 771   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.