Vulnerabilities (CVE)

Filtered by vendor Jenkins Subscribe
Total 1621 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2019-1003000 2 Jenkins, Redhat 2 Script Security, Openshift Container Platform 2024-11-21 6.5 MEDIUM 8.8 HIGH
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
CVE-2018-8718 1 Jenkins 1 Mailer 2024-11-21 6.0 MEDIUM 8.0 HIGH
Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.
CVE-2018-6356 2 Jenkins, Oracle 2 Jenkins, Communications Cloud Native Core Automated Test Suite 2024-11-21 4.0 MEDIUM 6.5 MEDIUM
Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files. This allowed users with Overall/Read permission to download files from the Jenkins master they should not have access to. On Windows, any file accessible to the Jenkins master process could be downloaded. On other operating systems, any file within the Jenkins home directory accessible to the Jenkins master process could be downloaded.
CVE-2018-1999047 1 Jenkins 1 Jenkins 2024-11-21 4.0 MEDIUM 6.5 MEDIUM
A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers to cancel a Jenkins restart scheduled through the update center.
CVE-2018-1999046 1 Jenkins 1 Jenkins 2024-11-21 4.0 MEDIUM 4.3 MEDIUM
A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attackers With Overall/Read permission to access the connection log for any agent.
CVE-2018-1999045 1 Jenkins 1 Jenkins 2024-11-21 5.5 MEDIUM 5.4 MEDIUM
A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled.
CVE-2018-1999044 1 Jenkins 1 Jenkins 2024-11-21 4.0 MEDIUM 6.5 MEDIUM
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
CVE-2018-1999043 1 Jenkins 1 Jenkins 2024-11-21 5.0 MEDIUM 7.5 HIGH
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.java that allows attackers to create ephemeral in-memory user records by attempting to log in using invalid credentials.
CVE-2018-1999042 1 Jenkins 1 Jenkins 2024-11-21 5.0 MEDIUM 5.3 MEDIUM
A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.
CVE-2018-1999041 1 Jenkins 1 Tinfoil Security 2024-11-21 2.1 LOW 5.5 MEDIUM
An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attackers with file system access to the Jenkins master to obtain the API secret key stored in this plugin's configuration.
CVE-2018-1999040 1 Jenkins 1 Kubernetes 2024-11-21 4.0 MEDIUM 8.8 HIGH
An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.
CVE-2018-1999039 1 Jenkins 1 Confluence Publisher 2024-11-21 4.0 MEDIUM 4.3 MEDIUM
A server-side request forgery vulnerability exists in Jenkins Confluence Publisher Plugin 2.0.1 and earlier in ConfluenceSite.java that allows attackers to have Jenkins submit login requests to an attacker-specified Confluence server URL with attacker specified credentials.
CVE-2018-1999038 1 Jenkins 1 Publish Over Cifs 2024-11-21 4.9 MEDIUM 4.2 MEDIUM
A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials.
CVE-2018-1999037 1 Jenkins 1 Resource Disposer 2024-11-21 4.0 MEDIUM 4.3 MEDIUM
A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop tracking a resource.
CVE-2018-1999036 1 Jenkins 1 Ssh Agent 2024-11-21 4.0 MEDIUM 6.5 MEDIUM
An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH private key password to users with permission to read the build log.
CVE-2018-1999035 1 Jenkins 1 Inedo Buildmaster 2024-11-21 5.8 MEDIUM 7.4 HIGH
A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMasterApi.java that allows attackers to impersonate any service that Jenkins connects to.
CVE-2018-1999034 1 Jenkins 1 Inedo Proget 2024-11-21 5.8 MEDIUM 7.4 HIGH
A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that allows attackers to impersonate any service that Jenkins connects to.
CVE-2018-1999031 1 Jenkins 1 Meliora Testlab 2024-11-21 4.0 MEDIUM 6.5 MEDIUM
An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that allows attackers with file system access to the Jenkins master to obtain the API key stored in this plugin's configuration.
CVE-2018-1999030 1 Jenkins 1 Maven Artifact Choicelistprovider \(nexus\) 2024-11-21 4.0 MEDIUM 5.4 MEDIUM
An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, Nexus3ChoiceListProvider.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.
CVE-2018-1999029 1 Jenkins 1 Shelve Project 2024-11-21 3.5 LOW 5.4 MEDIUM
A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.