CVE-2025-59475

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu e.g.,...

CVE-2025-59475

Jenkins versions 2.527 and earlier, including LTS 2.516.2 and earlier, are vulnerable to a missing authorization check in the authenticated user profile dropdown menu . This flaw allows authenticated users who lack Overall/Read permissions to obtain limited information about the Jenkins configura...

CVE-2025-59475

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu e.g.,...

Missing permission check in authenticated users' profile menu

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu. This allows attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu...

CVE-2024-47805

Jenkins Credentials Plugin 1380.va435002fa924 and earlier, except 1371.1373.v4ebfab7161e9, does not redact encrypted values of credentials using the SecretBytes type when accessing item config.xml via REST API or CLI...

CVE-2017-1000113

The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or users with Extended Read access to the jobs it is used in, to retrieve those passwords. The Deploy to container Plugin now integrates with...

CVE-2019-10436

An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master...

Jenkins plugins Multiple Vulnerabilities (2024-10-02)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Credentials Plugin 1380.va435002fa924 and earlier, except 1371.1373.v4ebfab7161e9, does not redact encrypted values of credentials...

com.blazemeter.plugins:blazemeterjenkinsplugin (>=1.04-beta-1, <=2.4), com.cloudbees.jenkins.plugins:bees-sdk-plugin (>=1.0, <=1.2) +8 more potentially affected by CVE-2024-47805 via org.jenkins-ci.plugins:credentials (1.3)

org.jenkins-ci.plugins:credentials MAVEN version 1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - com.blazemeter.plugins:blazemeterjenkinsplugin =1.04-beta-1, =1.0, =1.0, =1.0, =1.1, =0.1,...

com.mathworks.polyspace.jenkins:mathworks-polyspace (0.1.0), eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin (2.0.0) +4 more potentially affected by CVE-2024-47805 via org.jenkins-ci.plugins:credentials (1.14)

org.jenkins-ci.plugins:credentials MAVEN version 1.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - com.mathworks.polyspace.jenkins:mathworks-polyspace 0.1.0 -...

com.cloudbees.jenkins.plugins:mansion-cloud (>=1.16, <=1.25), com.lookout.jenkins:environment-script (1.2.5) +6 more potentially affected by CVE-2024-47805 via org.jenkins-ci.plugins:credentials (1.9.1)

org.jenkins-ci.plugins:credentials MAVEN version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - com.cloudbees.jenkins.plugins:mansion-cloud =1.16, =0.1, =1.3.0-beta, =2.7, =1.25, =1.26 -...

com.cloudcoreo.plugins:cloudcoreo-deploytime (>=0.1.0, <=0.2.3), com.github.kostyasha.yet-another-docker:yet-another-docker-plugin (>=0.1.0-rc16, <=0.2.0) +4 more potentially affected by CVE-2024-47805 via org.jenkins-ci.plugins:credentials (2.1.3)

org.jenkins-ci.plugins:credentials MAVEN version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - com.cloudcoreo.plugins:cloudcoreo-deploytime =0.1.0, =0.1.0-rc16, =0.1-beta, =0.4 -...

com.compuware.jenkins:compuware-common-configuration (>=1.0.2, <=1.0.11), com.compuware.jenkins:compuware-scm-downloader (>=2.0.0, <=2.0.5) +3 more potentially affected by CVE-2024-47805 via org.jenkins-ci.plugins:credentials (2.0.4)

org.jenkins-ci.plugins:credentials MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - com.compuware.jenkins:compuware-common-configuration =1.0.2, =2.0.0, =2.0, =1.0.2, =1.0.0,...

Jenkins Credentials plugin reveals encrypted values of credentials to users with Extended Read permission

Jenkins Credentials Plugin 1380.va435002fa924 and earlier, except 1371.1373.v4ebfab7161e9, does not redact encrypted values of credentials using the SecretBytes type e.g., Certificate credentials, or Secret file credentials from Plain Credentials Plugin when accessing item config.xml via REST API...

CVE-2024-47805

Jenkins Credentials Plugin 1380.va435002fa924 and earlier, except 1371.1373.v4ebfab7161e9, does not redact encrypted values of credentials using the SecretBytes type when accessing item config.xml via REST API or CLI...

CVE-2024-47805

Jenkins Credentials Plugin 1380.va435002fa924 and earlier, except 1371.1373.v4ebfab7161e9, does not redact encrypted values of credentials using the SecretBytes type when accessing item config.xml via REST API or CLI...

CVE-2024-47805

Jenkins Credentials Plugin 1380.va435002fa924 and earlier, except 1371.1373.v4ebfab7161e9, does not redact encrypted values of credentials using the SecretBytes type when accessing item config.xml via REST API or CLI...

CVE-2024-47805

Jenkins Credentials Plugin 1380.va435002fa924 and earlier, except 1371.1373.v4ebfab7161e9, does not redact encrypted values of credentials using the "SecretBytes" type when accessing item "config.xml" via REST API or CLI...

CVE-2024-47805

Jenkins Credentials Plugin 1380.va435002fa924 and earlier, except 1371.1373.v4ebfab7161e9, does not redact encrypted values of credentials using the SecretBytes type when accessing item config.xml via REST API or CLI...

CVE-2024-47805

CVE-2024-47805 affects Jenkins Credentials Plugin and does not redact encrypted values of credentials using the SecretBytes type in item config.xml accessed via REST API or CLI. Vulnerable versions include 1380.va_435002fa_924 and earlier, with some exceptions (e.g., 1371.1373.v4eb_fa_b_7161e9). ...