Jenkins

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-45385 1Jenkins 1Cloudbees Docker Hub/registry Notification Jun 17, 2026 Nov 15, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
CVE-2022-45384 1Jenkins 1Reverse Proxy Auth Jun 17, 2026 Nov 15, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins cont...Show more Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.Show less
CVE-2022-45383 1Jenkins 1Support Core Jun 17, 2026 Nov 15, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle permission to download a previously created support bundle containing information...Show more An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle permission to download a previously created support bundle containing information limited to users with Overall/Administer permission.Show less
CVE-2022-45382 1Jenkins 1Naginator Jun 17, 2026 Nov 15, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by att...Show more Jenkins Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to edit build display names.Show less
CVE-2022-45381 1Jenkins 1Pipeline Utility Steps Jun 17, 2026 Nov 15, 2022 N/A· v4 8.1 HIGH· v3 N/A· v2 Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator...Show more Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.Show less
CVE-2022-45380 1Jenkins 1Junit Jun 17, 2026 Nov 15, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attac...Show more Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.Show less
CVE-2022-45379 1Jenkins 1Script Security Jun 17, 2026 Nov 15, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collision attacks.
CVE-2022-38666 1Jenkins 1Ns Nd Integration Performance Publisher Jun 17, 2026 Nov 15, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several features.
CVE-2022-43435 1Jenkins 1360 Fireline Jun 17, 2026 Oct 19, 2022 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
CVE-2022-43434 1Jenkins 1Neuvector Vulnerability Scanner Jun 17, 2026 Oct 19, 2022 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for down...Show more Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.Show less
CVE-2022-43433 1Jenkins 1Screenrecorder Jun 17, 2026 Oct 19, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
CVE-2022-43432 1Jenkins 1Xframium Builder Jun 17, 2026 Oct 19, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
CVE-2022-43431 1Jenkins 1Compuware Strobe Measurement Jun 17, 2026 Oct 19, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in...Show more Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.Show less
CVE-2022-43430 1Jenkins 1Compuware Topaz For Total Test Jun 17, 2026 Oct 19, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-43429 1Jenkins 1Compuware Topaz For Total Test Jun 17, 2026 Oct 19, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary fi...Show more Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.Show less
CVE-2022-43428 1Jenkins 1Compuware Topaz For Total Test Jun 17, 2026 Oct 19, 2022 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values...Show more Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.Show less
CVE-2022-43427 1Jenkins 1Compuware Topaz For Total Test Jun 17, 2026 Oct 19, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials st...Show more Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.Show less
CVE-2022-43426 1Jenkins 1S3 Explorer Jun 17, 2026 Oct 19, 2022 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture it.
CVE-2022-43425 1Jenkins 1Custom Checkbox Parameter Jun 17, 2026 Oct 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of Custom Checkbox Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) v...Show more Jenkins Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of Custom Checkbox Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.Show less
CVE-2022-43424 1Jenkins 1Compuware Xpediter Code Coverage Jun 17, 2026 Oct 19, 2022 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the valu...Show more Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.Show less

Previous 1...242526...90 Next