Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
jenkins vulnerabilities and exploits
(subscribe to this query)
4.3
CVSSv3
CVE-2021-21670
Jenkins 2.299 and previous versions, LTS 2.289.1 and previous versions allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.
Jenkins Jenkins
9.1
CVSSv3
CVE-2021-21685
Jenkins 2.318 and previous versions, LTS 2.303.2 and previous versions does not check agent-to-controller access to create parent directories in FilePath#mkdirs.
Jenkins Jenkins
9.1
CVSSv3
CVE-2021-21689
FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and previous versions, LTS 2.303.2 and previous versions.
Jenkins Jenkins
9.8
CVSSv3
CVE-2021-21693
When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and previous versions, LTS 2.303.2 and previous versions.
Jenkins Jenkins
NA
CVE-2013-0327
Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins prior to 1.502 and LTS prior to 1.480.3 allows remote malicious users to hijack the authentication of users via unknown vectors.
Jenkins Jenkins
5.4
CVSSv3
CVE-2017-2599
Jenkins prior to 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).
Jenkins Jenkins
4.3
CVSSv3
CVE-2017-2600
In jenkins prior to 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343).
Jenkins Jenkins
5.4
CVSSv3
CVE-2017-2601
Jenkins prior to 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions.
Jenkins Jenkins
4.3
CVSSv3
CVE-2017-2602
jenkins prior to 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents (SECURITY-358).
Jenkins Jenkins
3.5
CVSSv3
CVE-2017-2603
Jenkins prior to 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362).
Jenkins Jenkins
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
remote code execution
CVE-2024-34909
CVE-2024-3317
SSTI
CVE-2024-3400
CVE-2024-30051
wireless
CVE-2024-4622
CVE-2024-4908
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
4
5
6
7
8
9
10
NEXT »