Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
jenkins vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2017-1000362
The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup directory with all old secrets, and the key used to encrypt them. These backups were world-readable and not removed afterwards. Jenkins n...
Jenkins Jenkins
4.8
CVSSv3
CVE-2017-1000392
Jenkins 2.88 and previous versions; 2.73.2 and previous versions Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters li...
Jenkins Jenkins
8.8
CVSSv3
CVE-2017-1000393
Jenkins 2.73.1 and previous versions, 2.83 and previous versions users with permission to create or configure agents in Jenkins could configure a launch method called 'Launch agent via execution of command on master'. This allowed them to run arbitrary shell commands on...
Jenkins Jenkins
5.9
CVSSv3
CVE-2017-1000396
Jenkins 2.73.1 and previous versions, 2.83 and previous versions bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. This library is widely used as...
Jenkins Jenkins
4.3
CVSSv3
CVE-2017-1000398
The remote API in Jenkins 2.73.1 and previous versions, 2.83 and previous versions at /computer/(agent-name)/api showed information about tasks (typically builds) currently running on that agent. This included information about tasks that the current user otherwise has no access ...
Jenkins Jenkins
4.3
CVSSv3
CVE-2017-1000399
The Jenkins 2.73.1 and previous versions, 2.83 and previous versions remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically builds waiting to start). This included information about tasks that the current user otherwise has no access to, e.g. du...
Jenkins Jenkins
4.3
CVSSv3
CVE-2017-1000400
The Jenkins 2.73.1 and previous versions, 2.83 and previous versions remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Re...
Jenkins Jenkins
2.2
CVSSv3
CVE-2017-1000401
The Jenkins 2.73.1 and previous versions, 2.83 and previous versions default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being l...
Jenkins Jenkins
8.1
CVSSv3
CVE-2017-1000504
A race condition during Jenkins 2.94 and previous versions; 2.89.1 and previous versions startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Pl...
Jenkins Jenkins
8.1
CVSSv3
CVE-2023-43498
In Jenkins 2.423 and previous versions, LTS 2.414.1 and previous versions, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers ...
Jenkins Jenkins
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
cross-site scripting
CVE-2024-5158
XML external entity
CVE-2024-4262
CVE-2024-2036
CVE-2024-4985
CVE-2024-21791
remote attackers
CVE-2023-43208
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
10
NEXT »