zaproxy

The Zed Attack Proxy ZAP by Checkmarx is the world’s most widely used web app scanner. Free and open source. A community based GitHub Top 1000 project that anyone can contribute to. It can help you automatically find security vulnerabilities in your we...

CVE-2025-53652-Jenkins-Git-Parameter-Analysis

CVE-2025-53652: Jenkins Git Parameter Plugin Unvalidated Input Vulnerability. Summary This vulnerability arises because user-controlled input from Jenkins build parameters is injected unsafely into the Git checkout command. User input is provided as a build parameter e.g., gitParameters, which ca...

jenkinsci__workflow-multibranch-plugin_CVE-2022-25175_706-vd43c65dec013

Pipeline: Multibranch Introduction Enhances Pipeline plugin to handle branches better by automatically grouping builds from different branches. Automatically creates a new Jenkins job whenever a new branch is pushed to a source code repository. Other plugins can define various branch types, e.g. ...

jenkinsci__workflow-cps-global-lib-plugin_CVE-2022-25174_544-vff04fa68714d

Bibliotecas Compartidas de Pipeline Cuando tienes múltiples trabajos de Pipeline, a menudo quieres compartir algunas partes de los scripts de Pipeline entre ellos para mantener los scripts de Pipeline DRY. Un caso de uso muy común es que tengas muchos proyectos que se construyen de manera similar...

CVE-2026-84676

Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2026-84676

Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin (version 26.1.0 and earlier) allow an attacker with Overall/Read permission to enumerate the IDs of credentials stored in Jenkins. The CVSS v3.1 base score is 5.4 (Medium) , reflecting a network-vector attack with low complexity and ...

CVE-2026-84666

Jenkins Job Configuration History Plugin versions 1367.vc8fa_b_15101dc and earlier are vulnerable to improper access control via Stapler data binding . The plugin incorrectly uses the @DataBoundConstructor annotation on a constructor for its global configuration, which is not intended to be invok...

CVE-2026-84666

Jenkins Job Configuration History Plugin 1367.vc8fab15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings...

CVE-2026-70444

A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70437

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...

CVE-2026-70439

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...

CVE-2026-70441

Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission...

CVE-2026-70438

A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70448

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

CVE-2026-70444

A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70442

Jenkins Google Chat Notification Plugin 166.ve6bde280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to use...

CVE-2026-70442

Jenkins Google Chat Notification Plugin 166.ve6bde280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to use...

CVE-2026-70441

Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission...

CVE-2026-70441

Summary: CVE-2026-70441 affects Jenkins’ Summary Display Plugin v1.15 and earlier. The root cause is failure to escape the job name in a JavaScript context on build report pages, enabling a stored XSS vulnerability. Impact/conditions: exploit requires Item/Create or Item/Configure permissions; th...