Jenkins

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-21655 1Jenkins 1P4 Jun 17, 2026 May 11, 2021 N/A· v4 7.1 HIGH· v3 5.8 MEDIUM· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password.
CVE-2021-21654 1Jenkins 1P4 Jun 17, 2026 May 11, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-speci...Show more Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.Show less
CVE-2021-21653 1Jenkins 1Xray Test Management For Jira Jun 17, 2026 May 11, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkin...Show more Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.Show less
CVE-2021-21652 1Jenkins 1Xray Test Management For Jira Jun 17, 2026 May 11, 2021 N/A· v4 7.1 HIGH· v3 5.8 MEDIUM· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obta...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2021-21651 1Jenkins 1S3 Publisher Jun 17, 2026 May 11, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain the list of configured profiles.
CVE-2021-21650 1Jenkins 1S3 Publisher Jun 17, 2026 May 11, 2021 N/A· v4 4.3 MEDIUM· v3 3.5 LOW· v2 Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts...Show more Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled.Show less
CVE-2021-21649 1Jenkins 1Dashboard View Jun 17, 2026 May 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure perm...Show more Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.Show less
CVE-2021-21648 1Jenkins 1Credentials Jun 17, 2026 May 11, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVE-2021-21647 1Jenkins 1Cloudbees Cd Jun 17, 2026 Apr 21, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedule builds of projects without having Item/Build permission.
CVE-2021-21646 1Jenkins 1Templating Engine Jun 17, 2026 Apr 21, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configure permission to execute arbitrary code in the context of the...Show more Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.Show less
CVE-2021-21645 1Jenkins 1Config File Provider Jun 17, 2026 Apr 21, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.
CVE-2021-21644 1Jenkins 1Config File Provider Jun 17, 2026 Apr 21, 2021 N/A· v4 5.4 MEDIUM· v3 5.8 MEDIUM· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.
CVE-2021-21643 1Jenkins 1Config File Provider Jun 17, 2026 Apr 21, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials...Show more Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.Show less
CVE-2021-21642 1Jenkins 1Config File Provider Jun 17, 2026 Apr 21, 2021 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21641 1Jenkins 1Promoted Builds Jun 17, 2026 Apr 7, 2021 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds.
CVE-2021-21640 1Jenkins 1Jenkins Jun 17, 2026 Apr 7, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.
CVE-2021-21639 1Jenkins 1Jenkins Jun 17, 2026 Apr 7, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure...Show more Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one of a different type.Show less
CVE-2021-28165 4Eclipse JenkinsNetapp+1 more 21Autovue For Agile Product Lifecycle Management Cloud ManagerCommunications Cloud Native Core Policy+18 more Jun 17, 2026 Apr 1, 2021 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVE-2021-21638 1Jenkins 1Team Foundation Server Jun 17, 2026 Mar 30, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained th...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2021-21637 1Jenkins 1Team Foundation Server Jun 17, 2026 Mar 30, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtai...Show more A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less

Previous 1...454647...90 Next