com.castlemon.hudson:cucumber-perf (>=1.1, <=2.0.6), org.jenkins-ci.main:jenkins-test-harness (1.519) +5 more potentially affected by CVE-2025-67636 via org.jenkins-ci.main:jenkins-core (1.519)

org.jenkins-ci.main:jenkins-core MAVEN version 1.519 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.castlemon.hudson:cucumber-perf =1.1, =1.3.4, =1.3.5 - org.jenkins-ci.plugins:plugin 1.519...

com.cloudbees.plugins:build-flow-plugin (0.18), com.companyline.hall.jenkins:hall-jenkins (>=1.0, <=1.2) +35 more potentially affected by CVE-2025-67637 via org.jenkins-ci.main:jenkins-core (1.509.1)

org.jenkins-ci.main:jenkins-core MAVEN version 1.509.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.plugins:build-flow-plugin 0.18 - com.companyline.hall.jenkins:hall-jenkins =1.0...

jp.shiftinc.jenkins.plugins:discard-old-build (>=1.04, <=1.05), org.jenkins-ci.main:jenkins-test-harness (1.515) +6 more potentially affected by CVE-2025-67636 via org.jenkins-ci.main:jenkins-core (1.515)

org.jenkins-ci.main:jenkins-core MAVEN version 1.515 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - jp.shiftinc.jenkins.plugins:discard-old-build =1.04, =1.05 -...

org.jenkins-ci.main:jenkins-test-harness (1.642), org.jenkins-ci.main:jenkins-war (1.642) +6 more potentially affected by CVE-2025-67637 via org.jenkins-ci.main:jenkins-core (1.642)

org.jenkins-ci.main:jenkins-core MAVEN version 1.642 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.642 - org.jenkins-ci.main:jenkins-war 1.642 -...

net.sleepymouse.jenkins.plugins:rpi-build-status (0.7), org.jenkins-ci.main:jenkins-war (1.658) +2 more potentially affected by CVE-2025-67637 via org.jenkins-ci.main:jenkins-core (1.658)

org.jenkins-ci.main:jenkins-core MAVEN version 1.658 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - net.sleepymouse.jenkins.plugins:rpi-build-status 0.7 - org.jenkins-ci.main:jenkins-war 1.658 -...

net.sleepymouse.jenkins.plugins:rpi-build-status (0.7), org.jenkins-ci.main:jenkins-war (1.658) +2 more potentially affected by CVE-2025-67636 via org.jenkins-ci.main:jenkins-core (1.658)

org.jenkins-ci.main:jenkins-core MAVEN version 1.658 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - net.sleepymouse.jenkins.plugins:rpi-build-status 0.7 - org.jenkins-ci.main:jenkins-war 1.658 -...

org.jenkins-ci.main:jenkins-test-harness (1.619), org.jenkins-ci.main:jenkins-war (1.619) +4 more potentially affected by CVE-2025-67637 via org.jenkins-ci.main:jenkins-core (1.619)

org.jenkins-ci.main:jenkins-core MAVEN version 1.619 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.619 - org.jenkins-ci.main:jenkins-war 1.619 -...

com.loadimpact:loadimpact-plugin (>=1.53, <=1.58), org.jenkins-ci.main:jenkins-test-harness (1.535) +5 more potentially affected by CVE-2025-67636 via org.jenkins-ci.main:jenkins-core (1.535)

org.jenkins-ci.main:jenkins-core MAVEN version 1.535 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.loadimpact:loadimpact-plugin =1.53, =1.18, =1.1, =1.2 - org.jenkins-ci.plugins:plugin 1.535...

org.jenkins-ci.main:jenkins-war (1.645), org.jenkins-ci.main:test (1.645) +5 more potentially affected by CVE-2025-67637 via org.jenkins-ci.main:jenkins-core (1.645)

org.jenkins-ci.main:jenkins-core MAVEN version 1.645 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.645 - org.jenkins-ci.main:test 1.645 -...

jp.shiftinc.jenkins.plugins:discard-old-build (>=1.04, <=1.05), org.jenkins-ci.main:jenkins-test-harness (1.515) +6 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:jenkins-core (1.515)

org.jenkins-ci.main:jenkins-core MAVEN version 1.515 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - jp.shiftinc.jenkins.plugins:discard-old-build =1.04, =1.05 -...

com.exxeta.jenkins.plugins:sidebar-update-notification (>=1.0.1, <=1.1.0), jp.shiftinc.jenkins.plugins:discard-old-build (>=1.0.3, <=1.03) +11 more potentially affected by CVE-2025-67638 via org.jenkins-ci.main:jenkins-core (1.500)

org.jenkins-ci.main:jenkins-core MAVEN version 1.500 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.exxeta.jenkins.plugins:sidebar-update-notification =1.0.1, =1.0.3, =2.6, =0.0.5, =0.2.0...

GHSA-FXJ7-6V9W-XC76 Jenkins's build authorization token is stored and displayed in plain text

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

Insufficiently Protected Credentials

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the display of build authorization tokens on the job configuration form. An attacker can gain unauthorized access to sensitive...

com.blazemeter.plugins:blazemeterjenkinsplugin (>=1.0-beta-1, <=1.08-beta-1), com.brianfromoregon:caliper-ci (2.1) +153 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:jenkins-core (1.424)

org.jenkins-ci.main:jenkins-core MAVEN version 1.424 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.blazemeter.plugins:blazemeterjenkinsplugin =1.0-beta-1, =0.1, =0.9, =1.2.11, =1.4.0, =2.7.0...

com.cloudbees.jenkins.plugins:additional-identities-plugin (1.0), com.cloudbees.plugins:build-flow-plugin (>=0.10, <=0.17) +85 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:jenkins-core (1.480)

org.jenkins-ci.main:jenkins-core MAVEN version 1.480 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:additional-identities-plugin 1.0 -...

com.exxeta.jenkins.plugins:sidebar-update-notification (>=1.0.1, <=1.1.0), jp.shiftinc.jenkins.plugins:discard-old-build (>=1.0.3, <=1.03) +11 more potentially affected by CVE-2025-67639 via org.jenkins-ci.main:jenkins-core (1.500)

org.jenkins-ci.main:jenkins-core MAVEN version 1.500 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.exxeta.jenkins.plugins:sidebar-update-notification =1.0.1, =1.0.3, =2.6, =0.0.5, =0.2.0...

org.cloudsmith.hammer.jenkins:stackhammer (1.0.0), org.jenkins-ci.main:jenkins-test-harness (1.467) +5 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:jenkins-core (1.467)

org.jenkins-ci.main:jenkins-core MAVEN version 1.467 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.cloudsmith.hammer.jenkins:stackhammer 1.0.0 - org.jenkins-ci.main:jenkins-test-harness 1.46...

Jenkins's build authorization token is stored and displayed in plain text

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

Cleartext Storage of Sensitive Information

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the storage of build authorization tokens in plain text within config.xml files. An attacker can gain unauthorized acces...

Jenkins's build authorization token is stored and displayed in plain text

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...