Jenkins

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-21675 1Jenkins 1Requests Jun 17, 2026 Jun 30, 2021 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests and/or have administrators apply pending requests.
CVE-2021-21674 1Jenkins 1Requests Jun 17, 2026 Jun 30, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the list of pending requests.
CVE-2021-21673 1Jenkins 1Cas Jun 17, 2026 Jun 30, 2021 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.
CVE-2021-21672 1Jenkins 1Selenium Html Report Jun 17, 2026 Jun 30, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21671 1Jenkins 1Jenkins Jun 17, 2026 Jun 30, 2021 N/A· v4 7.5 HIGH· v3 5.1 MEDIUM· v2 Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.
CVE-2021-21670 1Jenkins 1Jenkins Jun 17, 2026 Jun 30, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.
CVE-2021-21669 1Jenkins 1Generic Webhook Trigger Jun 17, 2026 Jun 18, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21668 1Jenkins 1Scriptler Jun 17, 2026 Jun 16, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
CVE-2021-21667 1Jenkins 1Scriptler Jun 17, 2026 Jun 16, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure...Show more Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.Show less
CVE-2021-21666 1Jenkins 1Kiuwan Jun 17, 2026 Jun 10, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVE-2021-21665 1Jenkins 1Xebialabs Xl Deploy Jun 17, 2026 Jun 10, 2021 N/A· v4 8.8 HIGH· v3 6.0 MEDIUM· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained throug...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.Show less
CVE-2021-21664 1Jenkins 1Xebialabs Xl Deploy Jun 17, 2026 Jun 10, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obta...Show more An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.Show less
CVE-2021-21663 1Jenkins 1Xebialabs Xl Deploy Jun 17, 2026 Jun 10, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained t...Show more A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.Show less
CVE-2021-21662 1Jenkins 1Xebialabs Xl Deploy Jun 17, 2026 Jun 10, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.
CVE-2021-21661 1Jenkins 1Kubernetes Jun 17, 2026 Jun 10, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...Show more Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.Show less
CVE-2021-21660 1Jenkins 1Markdown Formatter Jun 17, 2026 May 25, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any descrip...Show more Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter.Show less
CVE-2021-21659 1Jenkins 1Urltrigger Jun 17, 2026 May 25, 2021 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21658 1Jenkins 1Nuget Jun 17, 2026 May 25, 2021 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21657 1Jenkins 1Filesystem Trigger Jun 17, 2026 May 25, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21656 1Jenkins 1Xcode Integration Jun 17, 2026 May 11, 2021 N/A· v4 7.1 HIGH· v3 5.5 MEDIUM· v2 Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Previous 1...444546...90 Next