Jenkins

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-2235 1Jenkins 1Pipeline Maven Integration Jun 17, 2026 Aug 12, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obta...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.Show less
CVE-2020-2234 1Jenkins 1Pipeline Maven Integration Jun 17, 2026 Aug 12, 2020 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtain...Show more A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.Show less
CVE-2020-2233 1Jenkins 1Pipeline Maven Integration Jun 17, 2026 Aug 12, 2020 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVE-2020-2232 1Jenkins 1Email Extension Jun 17, 2026 Aug 12, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potentially resulting in its exposure.
CVE-2020-2231 1Jenkins 1Jenkins Jun 17, 2026 Aug 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable...Show more Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.Show less
CVE-2020-2230 1Jenkins 1Jenkins Jun 17, 2026 Aug 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permissi...Show more Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.Show less
CVE-2020-2229 1Jenkins 1Jenkins Jun 17, 2026 Aug 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
CVE-2020-2228 1Jenkins 1Gitlab Authentication Jun 17, 2026 Jul 15, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability.
CVE-2020-2227 1Jenkins 1Deployer Framework Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2226 1Jenkins 1Matrix Authorization Strategy Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2225 1Jenkins 1Matrix Project Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2224 1Jenkins 1Matrix Project Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2223 1Jenkins 1Jenkins Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2222 1Jenkins 1Jenkins Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2221 1Jenkins 1Jenkins Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2220 1Jenkins 1Jenkins Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2219 1Jenkins 1Link Column Jun 17, 2026 Jul 2, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2216 1Jenkins 1Zephyr For Jira Test Management Jun 17, 2026 Jul 2, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified username...Show more A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified username and password.Show less
CVE-2020-2215 1Jenkins 1Zephyr For Jira Test Management Jun 17, 2026 Jul 2, 2020 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified username and password...Show more A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified username and password.Show less
CVE-2020-2214 1Jenkins 1Zap Pipeline Jun 17, 2026 Jul 2, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.

Previous 1...525354...90 Next