Browse CVEs

MEDIUM 5.4 CVE-2022-34187 Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters on views d… Filesystem List Parameter after 0.0.7 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34188 Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying paramet… Hidden Parameter after 0.0.4 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34189 Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, … Image Tag Parameter after 1.10 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34190 Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact versions p… Maven Metadata after 2.1 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34191 Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying … Ns Nd Integration Performance Publisher after 4.8.0.77 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34192 Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, and Ontrack:… Ontrack after 4.0.0 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34193 Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resulting in … Package Version after 1.0.1 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34194 Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views… Readonly Parameter after 1.0.0 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34195 Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displ… Repository Connector after 2.2.0 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34196 Jenkins REST List Parameter Plugin 1.5.2 and earlier does not escape the name and description of REST list parameters on views displaying parameters,… Rest List Parameter after 1.5.2 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34197 Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parame… Sauce Ondemand after 1.204 Fix from $1,6002022-06-23 CRITICAL 9.1 CVE-2022-34181 Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't exist, and par… Xunit after 3.0.8 Fix from $2,3002022-06-23 HIGH 7.5 CVE-2022-34174 In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempt… Jenkins after 2.355 Fix from $1,9502022-06-23 HIGH 7.5 CVE-2022-34175 Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fr… Jenkins after 2.355 Fix from $1,9502022-06-23 HIGH 7.5 CVE-2022-34177 Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the … Pipeline\ after 448.v37cea_9a_10a_70 Fix from $1,9502022-06-23 HIGH 7.5 CVE-2022-34179 Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to choose a different SVG image sty… Embeddable Build Status after 2.0.3 Fix from $1,9502022-06-23 HIGH 7.5 CVE-2022-34180 Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides … Embeddable Build Status after 2.0.3 Fix from $1,9502022-06-23 MEDIUM 6.1 CVE-2022-34178 Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting po… Embeddable Build Status Mitigation only Fix from $1,6002022-06-23 MEDIUM 6.1 CVE-2022-34182 Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) … Nested View after 1.25 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34170 In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name t… Jenkins after 2.355 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34171 In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based S… Jenkins after 2.355 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34172 In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-s… Jenkins after 2.355 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34173 In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, re… Jenkins after 2.355 Fix from $1,6002022-06-23 MEDIUM 5.4 CVE-2022-34176EPSS 77% Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS)… Junit after 1119.va_a_5e9068da_d7 Fix from $1,6002022-06-23 HIGH 8.8 CVE-2022-30969 A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code… Autocomplete Parameter after 1.1 Fix from $1,9502022-05-17 HIGH 8.8 CVE-2022-30971 Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Storable Configs after 1.0 Fix from $1,9502022-05-17 HIGH 8.8 CVE-2022-30972 A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local X… Storage Configs after 1.0 Fix from $1,9502022-05-17 MEDIUM 5.4 CVE-2022-30968 Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting… Vboxwrapper after 1.3 Fix from $1,6002022-05-17 MEDIUM 5.4 CVE-2022-30970 Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsaf… Autocomplete Parameter after 1.1 Fix from $1,6002022-05-17 HIGH 8.8 CVE-2022-30958 A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH se… Ssh after 2.6.1 Fix from $1,9502022-05-17