Jenkins

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-40340 1Jenkins 1Nodejs Jun 17, 2026 Aug 16, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask (i.e., replace with asterisks) credentials specified in the Npm config file in Pipeline build logs.
CVE-2023-40339 1Jenkins 1Config File Provider Jun 17, 2026 Aug 16, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log.
CVE-2023-40338 1Jenkins 1Folders Jun 17, 2026 Aug 16, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available, exposing...Show more Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available, exposing information about the Jenkins controller file system.Show less
CVE-2023-40337 1Jenkins 1Folders Jun 17, 2026 Aug 16, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder.
CVE-2023-40336 1Jenkins 1Folders Jun 17, 2026 Aug 16, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders.
CVE-2023-3442 1Jenkins 1Servicenow Devops Jun 17, 2026 Jul 26, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To addres...Show more A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server. No changes are required on your instances of the Now Platform. Show less
CVE-2023-3414 1Jenkins 1Servicenow Devops Jun 17, 2026 Jul 26, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To a...Show more A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server. No changes are required on your instances of the Now Platform. Show less
CVE-2023-39156 1Jenkins 1Bazaar Jun 17, 2026 Jul 26, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags.
CVE-2023-39155 1Jenkins 1Chef Identity Jun 17, 2026 Jul 26, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it.
CVE-2023-39154 1Jenkins 1Qualys Web App Scanning Connector Jun 17, 2026 Jul 26, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified cr...Show more Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2023-39153 1Jenkins 1Gitlab Authentication Jun 17, 2026 Jul 26, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account.
CVE-2023-39152 1Jenkins 1Gradle Jun 17, 2026 Jul 26, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.
CVE-2023-39151 1Jenkins 1Jenkins Jun 17, 2026 Jul 26, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitabl...Show more Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.Show less
CVE-2023-37965 1Jenkins 1Elasticbox Ci Jun 17, 2026 Jul 12, 2023 N/A· v4 7.1 HIGH· v3 N/A· v2 A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through...Show more A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2023-37964 1Jenkins 1Elasticbox Ci Jun 17, 2026 Jul 12, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through anoth...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2023-37963 1Jenkins 1Benchmark Evaluator Jun 17, 2026 Jul 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.cs...Show more A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system.Show less
CVE-2023-37962 1Jenkins 1Benchmark Evaluator Jun 17, 2026 Jul 12, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, an...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system.Show less
CVE-2023-37961 1Jenkins 1Assembla Jun 17, 2026 Jul 12, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Auth Plugin 1.14 and earlier allows attackers to trick users into logging in to the attacker's account.
CVE-2023-37960 1Jenkins 1Mathworks Polyspace Jun 17, 2026 Jul 12, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file systems.
CVE-2023-37959 1Jenkins 1Sumologic Publisher Jun 17, 2026 Jul 12, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Previous 1...141516...90 Next