Jenkins

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-2239 1Jenkins 1Parameterized Remote Trigger Jun 17, 2026 Sep 1, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controll...Show more Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.Show less
CVE-2020-2238 1Jenkins 1Git Parameter Jun 17, 2026 Sep 1, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/C...Show more Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.Show less
CVE-2020-2237 1Jenkins 1Flaky Test Handler Jun 17, 2026 Aug 12, 2020 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Flaky Test Handler Plugin 1.0.4 and earlier allows attackers to rebuild a project at a previous git revision.
CVE-2020-2236 1Jenkins 1Yet Another Build Visualizer Jun 17, 2026 Aug 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Run/Update permission.
CVE-2020-2235 1Jenkins 1Pipeline Maven Integration Jun 17, 2026 Aug 12, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obta...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.Show less
CVE-2020-2234 1Jenkins 1Pipeline Maven Integration Jun 17, 2026 Aug 12, 2020 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtain...Show more A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.Show less
CVE-2020-2233 1Jenkins 1Pipeline Maven Integration Jun 17, 2026 Aug 12, 2020 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVE-2020-2232 1Jenkins 1Email Extension Jun 17, 2026 Aug 12, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potentially resulting in its exposure.
CVE-2020-2231 1Jenkins 1Jenkins Jun 17, 2026 Aug 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable...Show more Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.Show less
CVE-2020-2230 1Jenkins 1Jenkins Jun 17, 2026 Aug 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permissi...Show more Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.Show less
CVE-2020-2229 1Jenkins 1Jenkins Jun 17, 2026 Aug 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
CVE-2020-2228 1Jenkins 1Gitlab Authentication Jun 17, 2026 Jul 15, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability.
CVE-2020-2227 1Jenkins 1Deployer Framework Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2226 1Jenkins 1Matrix Authorization Strategy Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2225 1Jenkins 1Matrix Project Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2224 1Jenkins 1Matrix Project Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2223 1Jenkins 1Jenkins Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2222 1Jenkins 1Jenkins Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2221 1Jenkins 1Jenkins Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2220 1Jenkins 1Jenkins Jun 17, 2026 Jul 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

Previous 1...535455...92 Next