Jenkins

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-30515 1Jenkins 1Thycotic Devops Secrets Vault Jun 17, 2026 Apr 12, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
CVE-2023-30514 1Jenkins 1Azure Key Vault Jun 17, 2026 Apr 12, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
CVE-2023-30513 1Jenkins 1Kubernetes Jun 17, 2026 Apr 12, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
CVE-2023-28684 1Jenkins 1Remote Jobs View Jun 17, 2026 Apr 2, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28683 1Jenkins 1Phabricator Differential Jun 17, 2026 Apr 2, 2023 N/A· v4 8.2 HIGH· v3 N/A· v2 Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28682 1Jenkins 1Performance Publisher Jun 17, 2026 Apr 2, 2023 N/A· v4 8.2 HIGH· v3 N/A· v2 Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28681 1Jenkins 1Visual Studio Code Metrics Jun 17, 2026 Apr 2, 2023 N/A· v4 8.2 HIGH· v3 N/A· v2 Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28680 1Jenkins 1Crap4j Jun 17, 2026 Apr 2, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28679 1Jenkins 1Mashup Portlets Jun 17, 2026 Apr 2, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expression, resulting in a stored cross-site scripting (XSS) vulner...Show more Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expression, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.Show less
CVE-2023-28678 1Jenkins 1Cppcheck Jun 17, 2026 Apr 2, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacker...Show more Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control report file contents.Show less
CVE-2023-28677 1Jenkins 1Convert To Pipeline Jun 17, 2026 Apr 2, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowi...Show more Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a convertion by Jenkins Convert To Pipeline Plugin.Show less
CVE-2023-28676 1Jenkins 1Convert To Pipeline Jun 17, 2026 Apr 2, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freestyle project, potentially leading to remote code execution (RC...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freestyle project, potentially leading to remote code execution (RCE).Show less
CVE-2023-28675 1Jenkins 1Octoperf Load Testing Jun 17, 2026 Apr 2, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.
CVE-2023-28674 1Jenkins 1Octoperf Load Testing Jun 17, 2026 Apr 2, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentia...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.Show less
CVE-2023-28673 1Jenkins 1Octoperf Load Testing Jun 17, 2026 Apr 2, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2023-28672 1Jenkins 1Octoperf Load Testing Jun 17, 2026 Apr 2, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified UR...Show more Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2023-28671 1Jenkins 1Octoperf Load Testing Jun 17, 2026 Apr 2, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtaine...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2023-28670 1Jenkins 1Pipeline Aggregator View Jun 17, 2026 Apr 2, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by...Show more Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.Show less
CVE-2023-28669 1Jenkins 1Jacoco Jun 17, 2026 Apr 2, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control input files for the...Show more Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action.Show less
CVE-2023-28668 1Jenkins 1Role Based Authorization Strategy Jun 17, 2026 Apr 2, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.

Previous 1...192021...90 Next