Browse CVEs

HIGH 8.8 CVE-2019-1003005EPSS 19% A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbo… Script Security after 1.50 Fix from $1,9502019-02-06 HIGH 8.8 CVE-2019-1003006 A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that al… Groovy after 2.0 Fix from $1,9502019-02-06 HIGH 8.8 CVE-2019-1003007 A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.… Warnings after 5.0.0 Fix from $1,9502019-02-06 HIGH 8.8 CVE-2019-1003008 A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/an… Warnings Next Generation after 2.1.1 Fix from $1,9502019-02-06 HIGH 8.8 CVE-2019-1003016 An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimp… Job Import after 2.1 Fix from $1,9502019-02-06 HIGH 8.1 CVE-2019-1003011 An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugi… Token Macro after 2.5 Fix from $1,9502019-02-06 HIGH 7.4 CVE-2019-1003009 An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_di… Active Directory after 2.10 Fix from $1,9502019-02-06 MEDIUM 6.5 CVE-2019-1003012 A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-cor… Blue Ocean after 1.10.1 Fix from $1,6002019-02-06 MEDIUM 5.9 CVE-2019-1003019 An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorize… Github Oauth after 0.29 Fix from $1,6002019-02-06 MEDIUM 5.4 CVE-2019-1003013 An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean… Blue Ocean after 1.10.1 Fix from $1,6002019-02-06 MEDIUM 5.3 CVE-2019-1003017 A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from… Job Import after 3.0 Fix from $1,6002019-02-06 MEDIUM 6.5 CVE-2018-1000997 A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/o… Jenkins after 2.145 Fix from $1,6002019-01-23 HIGH 8.8 CVE-2019-1003000EPSS 98% A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy… Script Security after 1.49 Fix from $1,9502019-01-22 HIGH 8.8 CVE-2019-1003001EPSS 86% A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefiniti… Pipeline\ after 2.61 Fix from $1,9502019-01-22 HIGH 8.8 CVE-2019-1003002EPSS 81% A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/pl… Pipeline\ after 1.3.3 Fix from $1,9502019-01-22 HIGH 7.2 CVE-2019-1003003 An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBased… Jenkins after 2.158 Fix from $1,9502019-01-22 HIGH 7.2 CVE-2019-1003004 An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/Authentica… Jenkins after 2.159 Fix from $1,9502019-01-22 HIGH 8.8 CVE-2018-1000412 An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read acce… Jira after 3.0.1 Fix from $1,9502019-01-09 HIGH 8.1 CVE-2018-1000414 A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigF… Config File Provider after 3.1 Fix from $1,9502019-01-09 HIGH 8.1 CVE-2018-1000417 A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.java that … Email Extension Template after 1.0 Fix from $1,9502019-01-09 HIGH 7.8 CVE-2018-1000410 An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases,… Jenkins after 2.145 Fix from $1,9502019-01-09 MEDIUM 6.5 CVE-2018-1000406 A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.jav… Jenkins after 2.145 Fix from $1,6002019-01-09 MEDIUM 6.5 CVE-2018-1000408 A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSec… Jenkins after 2.145 Fix from $1,6002019-01-09 MEDIUM 6.5 CVE-2018-1000411 A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of … Junit after 1.25 Fix from $1,6002019-01-09 MEDIUM 6.1 CVE-2018-1000407 A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that al… Jenkins after 2.145 Fix from $1,6002019-01-09 MEDIUM 6.1 CVE-2018-1000426 A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangel… Git Changelog after 2.6 Fix from $1,6002019-01-09 MEDIUM 5.4 CVE-2018-1000409 A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecu… Jenkins after 2.145 Fix from $1,6002019-01-09 MEDIUM 5.4 CVE-2018-1000413 A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allo… Config File Provider after 3.1 Fix from $1,6002019-01-09 CRITICAL 9.8 CVE-2018-1000861 KEVEPSS 98% A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/mai… Jenkins after 2.153 Fix from $2,3002018-12-10 HIGH 8.8 CVE-2018-1000865 A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTr… Script Security after 1.47 Fix from $1,9502018-12-10