Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
jenkins vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2019-1003041
A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and previous versions allows malicious users to invoke arbitrary constructors in sandboxed scripts.
Jenkins Pipeline\\ Groovy
Redhat Openshift Container Platform 3.11
9.8
CVSSv3
CVE-2018-1000861
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and previous versions, LTS 2.138.3 and previous versions in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows malicious users to invoke some methods on Java objects by...
Jenkins Jenkins
Redhat Openshift Container Platform 3.11
13 Github repositories
9.8
CVSSv3
CVE-2017-1000353
Jenkins versions 2.56 and previous versions as well as 2.46.1 LTS and previous versions are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed malicious users to transfer a serialized Java `SignedObject` object t...
Jenkins Jenkins
Oracle Communications Cloud Native Core Automated Test Suite 1.9.0
1 EDB exploit
5 Github repositories
1 Article
9.8
CVSSv3
CVE-2017-1000245
The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file.
Jenkins Ssh
9.8
CVSSv3
CVE-2017-1000362
The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup directory with all old secrets, and the key used to encrypt them. These backups were world-readable and not removed afterwards. Jenkins n...
Jenkins Jenkins
9.8
CVSSv3
CVE-2017-3831
A vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could allow an unauthenticated, remote malicious user to bypass authentication. The attacker could be granted full administrator privileges. The vulnerability is due to improper implementatio...
Cisco Aironet Access Point Software 8.1\\(112.3\\)
Cisco Aironet Access Point Software 8.1\\(112.4\\)
Cisco Aironet Access Point Software 8.1\\(15.14\\)
Cisco Aironet Access Point Software 8.1\\(131.0\\)
9.8
CVSSv3
CVE-2016-0791
Jenkins prior to 1.650 and LTS prior to 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote malicious users to bypass a CSRF protection mechanism via a brute-force approach.
Redhat Openshift 3.1
Jenkins Jenkins
Jenkins Jenkins 1.642.1
9.6
CVSSv3
CVE-2023-27898
Jenkins 2.270 up to and including 2.393 (both inclusive), LTS 2.277.1 up to and including 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting i...
Jenkins Jenkins
9.6
CVSSv3
CVE-2023-27905
Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.
Jenkins Update-center2 3.14
Jenkins Update-center2 3.13
9.4
CVSSv3
CVE-2019-17638
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Bec...
Eclipse Jetty 9.4.29
Eclipse Jetty 9.4.28
Eclipse Jetty 9.4.27
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-29895
blind SQL injection
CVE-2024-5064
CVE-2023-52677
CVE-2023-52682
CVE-2024-30051
CVE-2024-35849
remote attackers
remote
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
2
3
4
5
6
7
8
9
10
NEXT »