Jenkins

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-30519 1Jenkins 1Quay.io Trigger Jun 17, 2026 Apr 12, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
CVE-2023-30518 1Jenkins 1Thycotic Secret Server Jun 17, 2026 Apr 12, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2023-30517 1Jenkins 1Neuvector Vulnerability Scanner Jun 17, 2026 Apr 12, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server.
CVE-2023-30516 1Jenkins 1Image Tag Parameter Jun 17, 2026 Apr 12, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resulting in job configurations using Image Tag Parameters that we...Show more Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resulting in job configurations using Image Tag Parameters that were created before 2.0 having SSL/TLS certificate validation disabled by default.Show less
CVE-2023-30515 1Jenkins 1Thycotic Devops Secrets Vault Jun 17, 2026 Apr 12, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
CVE-2023-30514 1Jenkins 1Azure Key Vault Jun 17, 2026 Apr 12, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
CVE-2023-30513 1Jenkins 1Kubernetes Jun 17, 2026 Apr 12, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
CVE-2023-28684 1Jenkins 1Remote Jobs View Jun 17, 2026 Apr 2, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28683 1Jenkins 1Phabricator Differential Jun 17, 2026 Apr 2, 2023 N/A· v4 8.2 HIGH· v3 N/A· v2 Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28682 1Jenkins 1Performance Publisher Jun 17, 2026 Apr 2, 2023 N/A· v4 8.2 HIGH· v3 N/A· v2 Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28681 1Jenkins 1Visual Studio Code Metrics Jun 17, 2026 Apr 2, 2023 N/A· v4 8.2 HIGH· v3 N/A· v2 Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28680 1Jenkins 1Crap4j Jun 17, 2026 Apr 2, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28679 1Jenkins 1Mashup Portlets Jun 17, 2026 Apr 2, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expression, resulting in a stored cross-site scripting (XSS) vulner...Show more Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expression, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.Show less
CVE-2023-28678 1Jenkins 1Cppcheck Jun 17, 2026 Apr 2, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacker...Show more Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control report file contents.Show less
CVE-2023-28677 1Jenkins 1Convert To Pipeline Jun 17, 2026 Apr 2, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowi...Show more Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a convertion by Jenkins Convert To Pipeline Plugin.Show less
CVE-2023-28676 1Jenkins 1Convert To Pipeline Jun 17, 2026 Apr 2, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freestyle project, potentially leading to remote code execution (RC...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freestyle project, potentially leading to remote code execution (RCE).Show less
CVE-2023-28675 1Jenkins 1Octoperf Load Testing Jun 17, 2026 Apr 2, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.
CVE-2023-28674 1Jenkins 1Octoperf Load Testing Jun 17, 2026 Apr 2, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentia...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.Show less
CVE-2023-28673 1Jenkins 1Octoperf Load Testing Jun 17, 2026 Apr 2, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2023-28672 1Jenkins 1Octoperf Load Testing Jun 17, 2026 Apr 2, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified UR...Show more Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less

Previous 1...202122...92 Next