Browse CVEs

HIGH 8.8 CVE-2023-41933 Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attac… Job Configuration History after 1229.v3039470161a_d Fix from $1,9502023-09-06 HIGH 8.8 CVE-2023-41939 Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly g… Ssh2 Easy after 1.4 Fix from $1,9502023-09-06 HIGH 7.5 CVE-2023-41935 Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking wh… Azure Ad after 396.v86ce29279947 Fix from $1,9502023-09-06 HIGH 7.5 CVE-2023-41936 Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are eq… Google Login after 1.7 Fix from $1,9502023-09-06 HIGH 7.5 CVE-2023-41937 Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain … Bitbucket Push And Pull Request after 2.8.3 Fix from $1,9502023-09-06 MEDIUM 6.5 CVE-2023-41938 A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules. Ivy after 2.5 Fix from $1,6002023-09-06 MEDIUM 5.3 CVE-2023-41934 Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentia… Pipeline Maven Integration after 1330.v18e473854496 Fix from $1,6002023-09-06 MEDIUM 6.5 CVE-2023-41932 Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowi… Job Configuration History after 1227.v7a_79fc4dc01f Fix from $1,6002023-09-06 MEDIUM 5.4 CVE-2023-41931 Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entrie… Job Configuration History after 1227.v7a_79fc4dc01f Fix from $1,6002023-09-06 MEDIUM 6.1 CVE-2023-4303 Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vulnerabili… Fortify 22.2.39+ Fix from $1,6002023-08-21 MEDIUM 5.4 CVE-2023-4301 A cross-site request forgery (CSRF) vulnerability in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers to connect to an attacker-specified … Fortify 22.2.39+ Fix from $1,6002023-08-21 MEDIUM 6.5 CVE-2023-40347 Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowing attac… Maven Artifact Choicelistprovider \(nexus\) after 1.14 Fix from $1,6002023-08-16 MEDIUM 5.4 CVE-2023-40346 Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting (XSS) vulnerabil… Shortcut Job after 0.4 Fix from $1,6002023-08-16 MEDIUM 5.4 CVE-2023-40350 Jenkins Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view, … Docker Swarm after 1.11 Fix from $1,6002023-08-16 MEDIUM 5.3 CVE-2023-40348 The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its outp… Gogs after 1.0.15 Fix from $1,6002023-08-16 MEDIUM 5.3 CVE-2023-40349 Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger… Gogs after 1.0.15 Fix from $1,6002023-08-16 HIGH 8.8 CVE-2023-40336 A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders. Folders after 6.846.v23698686f0f6 Fix from $1,9502023-08-16 HIGH 8.8 CVE-2023-40341 A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specifie… Blue Ocean after 1.27.5 Fix from $1,9502023-08-16 HIGH 7.5 CVE-2023-40339 Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configurat… Config File Provider after 952.va_544a_6234b_46 Fix from $1,9502023-08-16 HIGH 7.5 CVE-2023-40340 Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask (i.e., replace with asterisks) credentials specified in the Npm config file in Pipelin… Node.js after 1.6.0 Fix from $1,9502023-08-16 MEDIUM 6.5 CVE-2023-40345 Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Overall/Read permission… Delphix after 3.0.2 Fix from $1,6002023-08-16 MEDIUM 5.9 CVE-2023-40343 Jenkins Tuleap Authentication Plugin 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token allowing… Tuleap Authentication after 1.1.20 Fix from $1,6002023-08-16 MEDIUM 5.4 CVE-2023-40342 Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI, resulting in a stored cr… Flaky Test Handler after 1.2.2 Fix from $1,6002023-08-16 HIGH 7.5 CVE-2023-3442 A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully… Servicenow Devops 1.38.1+ Fix from $1,9502023-07-26 MEDIUM 6.5 CVE-2023-3414 A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited success… Servicenow Devops 1.38.1+ Fix from $1,6002023-07-26 MEDIUM 6.5 CVE-2023-39152 Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) … Gradle Mitigation only Fix from $1,6002023-07-26 MEDIUM 6.5 CVE-2023-39154 Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permiss… Qualys Web App Scanning Connector after 2.0.10 Fix from $1,6002023-07-26 MEDIUM 5.4 CVE-2023-39151 Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, re… Jenkins after 2.415 Fix from $1,6002023-07-26 MEDIUM 5.4 CVE-2023-39153 A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into log… Gitlab Authentication after 1.17.1 Fix from $1,6002023-07-26 MEDIUM 5.3 CVE-2023-39155 Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and captu… Chef Identity after 2.0.3 Fix from $1,6002023-07-26