Jenkins

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-21659 1Jenkins 1Urltrigger Jun 17, 2026 May 25, 2021 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21658 1Jenkins 1Nuget Jun 17, 2026 May 25, 2021 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21657 1Jenkins 1Filesystem Trigger Jun 17, 2026 May 25, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21656 1Jenkins 1Xcode Integration Jun 17, 2026 May 11, 2021 N/A· v4 7.1 HIGH· v3 5.5 MEDIUM· v2 Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21655 1Jenkins 1P4 Jun 17, 2026 May 11, 2021 N/A· v4 7.1 HIGH· v3 5.8 MEDIUM· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password.
CVE-2021-21654 1Jenkins 1P4 Jun 17, 2026 May 11, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-speci...Show more Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.Show less
CVE-2021-21653 1Jenkins 1Xray Test Management For Jira Jun 17, 2026 May 11, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkin...Show more Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.Show less
CVE-2021-21652 1Jenkins 1Xray Test Management For Jira Jun 17, 2026 May 11, 2021 N/A· v4 7.1 HIGH· v3 5.8 MEDIUM· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obta...Show more A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2021-21651 1Jenkins 1S3 Publisher Jun 17, 2026 May 11, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain the list of configured profiles.
CVE-2021-21650 1Jenkins 1S3 Publisher Jun 17, 2026 May 11, 2021 N/A· v4 4.3 MEDIUM· v3 3.5 LOW· v2 Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts...Show more Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled.Show less
CVE-2021-21649 1Jenkins 1Dashboard View Jun 17, 2026 May 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure perm...Show more Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.Show less
CVE-2021-21648 1Jenkins 1Credentials Jun 17, 2026 May 11, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVE-2021-21647 1Jenkins 1Cloudbees Cd Jun 17, 2026 Apr 21, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedule builds of projects without having Item/Build permission.
CVE-2021-21646 1Jenkins 1Templating Engine Jun 17, 2026 Apr 21, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configure permission to execute arbitrary code in the context of the...Show more Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.Show less
CVE-2021-21645 1Jenkins 1Config File Provider Jun 17, 2026 Apr 21, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.
CVE-2021-21644 1Jenkins 1Config File Provider Jun 17, 2026 Apr 21, 2021 N/A· v4 5.4 MEDIUM· v3 5.8 MEDIUM· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.
CVE-2021-21643 1Jenkins 1Config File Provider Jun 17, 2026 Apr 21, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials...Show more Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins.Show less
CVE-2021-21642 1Jenkins 1Config File Provider Jun 17, 2026 Apr 21, 2021 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21641 1Jenkins 1Promoted Builds Jun 17, 2026 Apr 7, 2021 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds.
CVE-2021-21640 1Jenkins 1Jenkins Jun 17, 2026 Apr 7, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.

Previous 1...464748...92 Next