Jenkins

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-38664 1Jenkins 1Job Configuration History Jun 17, 2026 Aug 23, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by...Show more Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.Show less
CVE-2022-38663 1Jenkins 1Git Jun 17, 2026 Aug 23, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.
CVE-2022-36922 1Jenkins 1Lucene Search Jun 17, 2026 Jul 27, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVE-2022-36921 1Jenkins 1Coverity Jun 17, 2026 Jul 27, 2022 N/A· v4 8.1 HIGH· v3 N/A· v2 A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through ano...Show more A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2022-36920 1Jenkins 1Coverity Jun 17, 2026 Jul 27, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another m...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2022-36919 1Jenkins 1Coverity Jun 17, 2026 Jul 27, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-36918 1Jenkins 1Buckminster Jun 17, 2026 Jul 27, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specifi...Show more Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.Show less
CVE-2022-36917 1Jenkins 1Google Cloud Backup Jun 17, 2026 Jul 27, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup.
CVE-2022-36916 1Jenkins 1Google Cloud Backup Jun 17, 2026 Jul 27, 2022 N/A· v4 8.0 HIGH· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup.
CVE-2022-36915 1Jenkins 1Android Signing Jun 17, 2026 Jul 27, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure per...Show more Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.Show less
CVE-2022-36914 1Jenkins 1Files Found Trigger Jun 17, 2026 Jul 27, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-s...Show more Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.Show less
CVE-2022-36913 1Jenkins 1Openstack Heat Jun 17, 2026 Jul 27, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specifie...Show more Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.Show less
CVE-2022-36912 1Jenkins 1Openstack Heat Jun 17, 2026 Jul 27, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-36911 1Jenkins 1Openstack Heat Jun 17, 2026 Jul 27, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attacker-specified URL.
CVE-2022-36910 1Jenkins 1Lucene Search Jun 17, 2026 Jul 27, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to reindex the database and to obtain information...Show more Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them.Show less
CVE-2022-36909 1Jenkins 1Openshift Deployer Jun 17, 2026 Jul 27, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file...Show more A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system to an attacker-specified URL.Show less
CVE-2022-36908 1Jenkins 1Openshift Deployer Jun 17, 2026 Jul 27, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the existence of an attacker-specified file path on the Jenkins controller file syste...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system to an attacker-specified URL.Show less
CVE-2022-36907 1Jenkins 1Openshift Deployer Jun 17, 2026 Jul 27, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
CVE-2022-36906 1Jenkins 1Openshift Deployer Jun 17, 2026 Jul 27, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.
CVE-2022-36905 1Jenkins 1Maven Metadata Jun 17, 2026 Jul 27, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters, resulting in a stored cross-site scriptin...Show more Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.Show less

Previous 1...293031...92 Next