Jenkins

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-24423 1Jenkins 1Gerrit Trigger Jun 17, 2026 Jan 26, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit.
CVE-2023-24422 1Jenkins 1Script Security Jun 17, 2026 Jan 26, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to b...Show more A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.Show less
CVE-2022-46688 1Jenkins 1Sonar Gerrit Jun 17, 2026 Dec 12, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenkins administrators)...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenkins administrators) using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.Show less
CVE-2022-46687 1Jenkins 1Spring Config Jun 17, 2026 Dec 12, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to change b...Show more Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to change build display names.Show less
CVE-2022-46686 1Jenkins 1Custom Build Properties Jun 17, 2026 Dec 12, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom Build Properties and Build Summary pages, resulting in a stored cross-site scrip...Show more Jenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom Build Properties and Build Summary pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set or change these values.Show less
CVE-2022-46684 1Jenkins 1Checkmarx Jun 17, 2026 Dec 12, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting in a stored cross-site scripting (XSS) vulnerability.
CVE-2022-46683 1Jenkins 1Google Login Jun 17, 2026 Dec 12, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
CVE-2022-46682 1Jenkins 1Plot Jun 17, 2026 Dec 12, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-45401 1Jenkins 1Associated Files Jun 17, 2026 Nov 15, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-45400 1Jenkins 1Japex Jun 17, 2026 Nov 15, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-45399 1Jenkins 1Cluster Statistics Jun 17, 2026 Nov 15, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics.
CVE-2022-45398 1Jenkins 1Cluster Statistics Jun 17, 2026 Nov 15, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics.
CVE-2022-45397 1Jenkins 1Osf Builder Suite \ Jun 17, 2026 Nov 15, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-45396 1Jenkins 1Sourcemonitor Jun 17, 2026 Nov 15, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-45395 1Jenkins 1Cccc Jun 17, 2026 Nov 15, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-45394 1Jenkins 1Delete Log Jun 17, 2026 Nov 15, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs.
CVE-2022-45393 1Jenkins 1Delete Log Jun 17, 2026 Nov 15, 2022 N/A· v4 3.5 LOW· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs.
CVE-2022-45392 1Jenkins 1Ns Nd Integration Performance Publisher Jun 17, 2026 Nov 15, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permiss...Show more Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system.Show less
CVE-2022-45391 1Jenkins 1Ns Nd Integration Performance Publisher Jun 17, 2026 Nov 15, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM.
CVE-2022-45390 1Jenkins 1Loader.io Jun 17, 2026 Nov 15, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins loader.io Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Previous 1...242526...92 Next