Jenkins

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-32979 1Jenkins 1Email Extension Jun 17, 2026 May 16, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ dir...Show more Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system.Show less
CVE-2023-32978 1Jenkins 1Lightweight Directory Access Protocol Jun 17, 2026 May 16, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.
CVE-2023-32977 1Jenkins 1Pipeline\ Jun 17, 2026 May 16, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set b...Show more Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately.Show less
CVE-2023-30532 1Jenkins 1Turboscript Jun 17, 2026 Apr 12, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository.
CVE-2023-30531 1Jenkins 1Consul Kv Builder Jun 17, 2026 Apr 12, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it.
CVE-2023-30530 1Jenkins 1Consul Kv Builder Jun 17, 2026 Apr 12, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins...Show more Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.Show less
CVE-2023-30529 1Jenkins 1Lucene Search Jun 17, 2026 Apr 12, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database.
CVE-2023-30528 1Jenkins 1Wso2 Oauth Jun 17, 2026 Apr 12, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers to observe and capture it.
CVE-2023-30527 1Jenkins 1Wso2 Oauth Jun 17, 2026 Apr 12, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file...Show more Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.Show less
CVE-2023-30526 1Jenkins 1Report Portal Jun 17, 2026 Apr 12, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified bearer token authentication.
CVE-2023-30525 1Jenkins 1Report Portal Jun 17, 2026 Apr 12, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified bearer token authentication.
CVE-2023-30524 1Jenkins 1Report Portal Jun 17, 2026 Apr 12, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and capture them.
CVE-2023-30523 1Jenkins 1Report Portal Jun 17, 2026 Apr 12, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration where they can be viewed by users with Item/Extend...Show more Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.Show less
CVE-2023-30522 1Jenkins 1Fogbugz Jun 17, 2026 Apr 12, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobs specified in a 'jobname' request parameter.
CVE-2023-30521 1Jenkins 1Assembla Merge Request Builder Jun 17, 2026 Apr 12, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
CVE-2023-30520 1Jenkins 1Quay.io Trigger Jun 17, 2026 Apr 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by...Show more Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads.Show less
CVE-2023-30519 1Jenkins 1Quay.io Trigger Jun 17, 2026 Apr 12, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
CVE-2023-30518 1Jenkins 1Thycotic Secret Server Jun 17, 2026 Apr 12, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2023-30517 1Jenkins 1Neuvector Vulnerability Scanner Jun 17, 2026 Apr 12, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server.
CVE-2023-30516 1Jenkins 1Image Tag Parameter Jun 17, 2026 Apr 12, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resulting in job configurations using Image Tag Parameters that we...Show more Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resulting in job configurations using Image Tag Parameters that were created before 2.0 having SSL/TLS certificate validation disabled by default.Show less

Previous 1...181920...90 Next