Lucene search

K

Jenkins HTTP Request Plugin Security Vulnerabilities

cve
cve

CVE-2023-50766

A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as...

8.8CVSS

8.6AI Score

0.001EPSS

2023-12-13 06:15 PM
15
cve
cve

CVE-2023-50768

A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

8.8CVSS

8.6AI Score

0.001EPSS

2023-12-13 06:15 PM
16
cve
cve

CVE-2023-50767

Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as...

5.4CVSS

5.3AI Score

0.0004EPSS

2023-12-13 06:15 PM
17
cve
cve

CVE-2023-32998

A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified...

8.8CVSS

8.6AI Score

0.001EPSS

2023-05-16 05:15 PM
18
cve
cve

CVE-2023-32996

A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending...

4.3CVSS

4.5AI Score

0.0005EPSS

2023-05-16 05:15 PM
20
cve
cve

CVE-2023-32999

A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified...

4.3CVSS

4.4AI Score

0.0005EPSS

2023-05-16 05:15 PM
20
cve
cve

CVE-2023-32995

A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending...

8.8CVSS

8.7AI Score

0.001EPSS

2023-05-16 05:15 PM
19
cve
cve

CVE-2023-32991

A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as...

8.8CVSS

8.5AI Score

0.001EPSS

2023-05-16 05:15 PM
19
cve
cve

CVE-2023-32992

Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as...

8.8CVSS

8.4AI Score

0.001EPSS

2023-05-16 05:15 PM
21
cve
cve

CVE-2023-23847

A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

3.5CVSS

4.1AI Score

0.0005EPSS

2023-02-15 07:15 PM
24
cve
cve

CVE-2023-24432

A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

8.8CVSS

8.6AI Score

0.001EPSS

2023-01-26 09:18 PM
35
cve
cve

CVE-2019-1003008

A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP...

8.8CVSS

8.8AI Score

0.001EPSS

2022-10-03 04:19 PM
22
cve
cve

CVE-2019-1003007

A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP...

8.8CVSS

8.8AI Score

0.001EPSS

2022-10-03 04:19 PM
24
cve
cve

CVE-2022-41253

A cross-site request forgery (CSRF) vulnerability in Jenkins CONS3RT Plugin 1.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

8.8CVSS

8.6AI Score

0.001EPSS

2022-09-21 04:15 PM
54
6
cve
cve

CVE-2022-41249

A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

8.8CVSS

8.6AI Score

0.001EPSS

2022-09-21 04:15 PM
48
5
cve
cve

CVE-2022-36901

Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file...

6.5CVSS

6.3AI Score

0.001EPSS

2022-07-27 03:15 PM
49
3
cve
cve

CVE-2022-34814

Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending...

4.3CVSS

4.8AI Score

0.001EPSS

2022-06-30 06:15 PM
232
3
cve
cve

CVE-2022-34797

A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified...

4.3CVSS

4.9AI Score

0.001EPSS

2022-06-30 06:15 PM
245
3
cve
cve

CVE-2022-34794

Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as...

6.5CVSS

6.6AI Score

0.001EPSS

2022-06-30 06:15 PM
230
3
cve
cve

CVE-2022-34792

A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as...

8CVSS

7.8AI Score

0.001EPSS

2022-06-30 06:15 PM
255
3
cve
cve

CVE-2022-34780

A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

6.5CVSS

6.6AI Score

0.001EPSS

2022-06-30 06:15 PM
239
3
cve
cve

CVE-2022-34212

A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified...

5.7CVSS

5.3AI Score

0.001EPSS

2022-06-23 05:15 PM
74
4
cve
cve

CVE-2022-34211

A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an attacker-specified...

6.5CVSS

6.2AI Score

0.001EPSS

2022-06-23 05:15 PM
65
4
cve
cve

CVE-2022-34203

A cross-site request forgery (CSRF) vulnerability in Jenkins EasyQA Plugin 1.0 and earlier allows attackers to connect to an attacker-specified HTTP...

8.8CVSS

8.6AI Score

0.001EPSS

2022-06-23 05:15 PM
68
2
cve
cve

CVE-2022-34205

A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an attacker-specified...

6.5CVSS

6.3AI Score

0.001EPSS

2022-06-23 05:15 PM
76
3
cve
cve

CVE-2022-30953

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP...

6.5CVSS

6.4AI Score

0.001EPSS

2022-05-17 03:15 PM
111
2
cve
cve

CVE-2022-30946

A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified...

4.3CVSS

4.7AI Score

0.001EPSS

2022-05-17 03:15 PM
86
3
cve
cve

CVE-2022-25208

A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML...

8.8CVSS

8.4AI Score

0.001EPSS

2022-02-15 05:15 PM
105
cve
cve

CVE-2022-25207

A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML...

8.8CVSS

8.6AI Score

0.001EPSS

2022-02-15 05:15 PM
123
cve
cve

CVE-2020-2215

A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified username and...

4.3CVSS

4.5AI Score

0.001EPSS

2020-07-02 03:15 PM
44
cve
cve

CVE-2019-16551

A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified...

8.8CVSS

8.6AI Score

0.001EPSS

2019-12-17 03:15 PM
39
cve
cve

CVE-2019-10388

A cross-site request forgery vulnerability in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified...

4.3CVSS

4.5AI Score

0.001EPSS

2019-08-07 03:15 PM
34
cve
cve

CVE-2019-1003027

A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL and obtain the HTTP response code if successful, and exception...

4.3CVSS

4.6AI Score

0.001EPSS

2019-02-20 09:29 PM
25