Jenkins

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-10360 1Jenkins 1M2 Release Jun 17, 2026 Jul 31, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
CVE-2019-10359 1Jenkins 1M2release Jun 17, 2026 Jul 31, 2019 N/A· v4 6.3 MEDIUM· v3 6.8 MEDIUM· v2 A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doSubmit method allowed attackers to perform releases with attacker-specified options.
CVE-2019-10358 1Jenkins 1Maven Jun 17, 2026 Jul 31, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log.
CVE-2019-10357 2Jenkins Redhat 2Openshift Container Platform Pipeline\ Jun 17, 2026 Jul 31, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by glo...Show more A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.Show less
CVE-2019-10356 2Jenkins Redhat 2Openshift Container Platform Script Security Jun 17, 2026 Jul 31, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts.
CVE-2019-10355 2Jenkins Redhat 2Openshift Container Platform Script Security Jun 17, 2026 Jul 31, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.
CVE-2019-10345 1Jenkins 1Configuration As Code Jun 17, 2026 Jul 31, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export.
CVE-2019-10344 1Jenkins 1Configuration As Code Jun 17, 2026 Jul 31, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin contain...Show more Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins.Show less
CVE-2019-10343 1Jenkins 1Configuration As Code Jun 17, 2026 Jul 31, 2019 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being applied.
CVE-2019-1010241 1Jenkins 1Credentials Binding Jun 17, 2026 Jul 19, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly lin...Show more Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line #30 (passwordVariable). The attack vector is: Attacker creates and executes a Jenkins job.Show less
CVE-2019-10354 2Jenkins Redhat 2Jenkins Openshift Container Platform Jun 17, 2026 Jul 17, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive infor...Show more A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.Show less
CVE-2019-10353 1Jenkins 1Jenkins Jun 17, 2026 Jul 17, 2019 N/A· v4 7.5 HIGH· v3 5.1 MEDIUM· v2 CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.
CVE-2019-10352 1Jenkins 1Jenkins Jun 17, 2026 Jul 17, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter w...Show more A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.Show less
CVE-2019-10351 1Jenkins 1Caliper Ci Jun 17, 2026 Jul 11, 2019 N/A· v4 8.8 HIGH· v3 4.0 MEDIUM· v2 Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVE-2019-10350 1Jenkins 1Port Allocator Jun 17, 2026 Jul 11, 2019 N/A· v4 8.8 HIGH· v3 4.0 MEDIUM· v2 Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVE-2019-10349 1Jenkins 1Dependency Graph Viewer Jun 17, 2026 Jul 11, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided we...Show more A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.Show less
CVE-2019-10348 1Jenkins 1Gogs Jun 17, 2026 Jul 11, 2019 N/A· v4 8.8 HIGH· v3 4.0 MEDIUM· v2 Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVE-2019-10347 1Jenkins 1Mashup Portlets Jun 17, 2026 Jul 11, 2019 N/A· v4 8.8 HIGH· v3 4.0 MEDIUM· v2 Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system.
CVE-2019-10346 1Jenkins 1Embeddable Build Status Jun 17, 2026 Jul 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin.
CVE-2019-10342 1Jenkins 1Docker Jun 17, 2026 Jul 11, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

Previous 1...676869...90 Next