Browse CVEs

HIGH 7.3 CVE-2016-3102 The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that pe… Script Security Mitigation only Fix from $1,9502017-02-09 MEDIUM 6.5 CVE-2016-4987 Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories and read ar… Image Gallery 1.4+ Fix from $1,6002017-02-09 MEDIUM 6.1 CVE-2016-4988 Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary we… Build Failure Analyzer 1.16.0+ Fix from $1,6002017-02-09 MEDIUM 5.4 CVE-2016-3101 Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web script or… Extra Columns 1.17+ Fix from $1,6002017-02-09 CRITICAL 9.8 CVE-2016-9299EPSS 97% The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java obje… Jenkins after 2.31 Fix from $2,3002017-01-12 HIGH 7.4 CVE-2016-3726 Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites a… Jenkins after 2.2 Fix from $1,9502016-05-17 HIGH 8.8 CVE-2016-0792EPSS 83% Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via seri… Jenkins after 1.649 Fix from $1,9502016-04-07 MEDIUM 6.1 CVE-2016-0789 CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitr… Jenkins after 1.649 Fix from $1,6002016-04-07 MEDIUM 5.3 CVE-2016-0790 Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to … Jenkins after 1.649 Fix from $1,6002016-04-07 CRITICAL 9.8 CVE-2016-0788EPSS 12% The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener. Jenkins after 1.649 Fix from $2,3002016-04-07 HIGH 7.5 CVE-2015-7539 The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which m… Jenkins after 1.639 Fix from $1,9502016-02-03 HIGH 8.8 CVE-2015-7538 Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors. Jenkins after 3.1 Fix from $1,9502016-02-03 MEDIUM 5.4 CVE-2015-7536 Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web scr… Jenkins after 1.639 Fix from $1,6002016-02-03 MEDIUM 5.0 CVE-2015-5324 Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api. Jenkins after 3.1 Fix from $1,6002015-11-25 MEDIUM 6.8 CVE-2015-5318 Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote atta… Jenkins after 3.1 Fix from $1,6002015-11-25 HIGH 7.5 CVE-2015-5317 KEVEPSS 22% The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information… Jenkins after 3.1 Fix from $1,9502015-11-25 MEDIUM 6.8 CVE-2014-3665 Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote attackers t… Jenkins after 1.586 Fix from $1,6002015-11-25 HIGH 7.5 CVE-2015-1814 The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token chang… Jenkins after 3.1 Fix from $1,9502015-10-16 MEDIUM 6.5 CVE-2015-1806 The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permissi… Jenkins after 3.1 Fix from $1,6002015-10-16 HIGH 7.5 CVE-2014-2063 Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors. Jenkins after 1.550 Fix from $1,9502014-10-17 MEDIUM 6.8 CVE-2014-2066 Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving th… Jenkins after 1.550 Fix from $1,6002014-10-17 MEDIUM 6.5 CVE-2014-2058 BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary job… Jenkins after 1.550 Fix from $1,6002014-10-17 MEDIUM 6.5 CVE-2014-2062 Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to reta… Jenkins after 1.550 Fix from $1,6002014-10-17 MEDIUM 5.0 CVE-2014-2060 The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors. Jenkins after 1.550 Fix from $1,6002014-10-17 MEDIUM 5.0 CVE-2014-2061 The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by readin… Jenkins after 1.550 Fix from $1,6002014-10-17 MEDIUM 5.0 CVE-2014-2064 The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attac… Jenkins after 1.550 Fix from $1,6002014-10-17 MEDIUM 6.0 CVE-2014-3663 Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and c… Jenkins after 3.1 Fix from $1,6002014-10-16 MEDIUM 5.0 CVE-2014-3662 Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts. Jenkins after 3.1 Fix from $1,6002014-10-16 MEDIUM 6.5 CVE-2014-2059 Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in Jenkins before 1.551 and LTS before 1.532.2 allows re… Jenkins after 1.550 Fix from $1,6002014-03-01 HIGH 7.5 CVE-2013-0329 Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown … Jenkins after 1.501 Fix from $1,9502013-03-19