Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6673
Adobe 6383
Ibm 6286
Cisco 5751
Debian 3919
Mozilla 2886
Apache 2864
Redhat 2586
Warnings
HIGH 8.8
Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with use…
Release
HIGH 8.8
Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attacker…
Translation Assistance
HIGH 8.8
Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability a…
Ssh
CRITICAL 9.8
The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH ke…
Favorite
HIGH 8.8
Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification
Script Security
HIGH 8.8
Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations,…
Blue Ocean
HIGH 8.5
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing …
Pipeline Input Step
HIGH 7.5
The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has bee…
Config File Provider
MEDIUM 6.5
The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with only Overal…
Owasp Dependency Check
MEDIUM 6.1
The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scripting vuln…
Deploy
MEDIUM 5.5
The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system ac…
Static Analysis Utilities
MEDIUM 5.4
The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users a…
Dry
MEDIUM 5.4
The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Maliciou…
Blue Ocean
MEDIUM 5.3
The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before providing acc…
Role Based Authorization Strategy
HIGH 8.8
Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery…
Poll Scm
HIGH 8.8
Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed at…
Pipeline\
HIGH 8.8
Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline sc…
Periodic Backup
HIGH 8.0
The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups,…
Git
HIGH 7.5
Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at …
Parameterized Trigger
MEDIUM 6.5
Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was run…
Subversion
MEDIUM 6.5
Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality…
Docker Commons
MEDIUM 6.5
Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to authentic…
Script Security
MEDIUM 6.5
The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, S…
Github Branch Source
MEDIUM 6.3
GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to v…
Sidebar Link
MEDIUM 5.4
The Sidebar Link plugin allows users able to configure jobs, views, and agents to add entries to the sidebar of these objects. There was no input val…
Pipeline\
MEDIUM 5.3
Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. …
Jenkins
MEDIUM 5.3
Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers t…
Jenkins
MEDIUM 5.3
Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it eas…
Jenkins
CRITICAL 9.8
The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup direct…
Tap
HIGH 7.5
Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecified paramet…