CVE-2022-29052

Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-29049

Jenkins promoted builds Plugin 873.v6149dbd64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name...

CVE-2022-29050

A cross-site request forgery CSRF vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attacker-specified credentials...

CVE-2022-29044

Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

PT-2022-19390 · Jenkins · Jenkins Publish Over Ftp Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Publish Over FTP Plugin versions 1.16 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an FTP server using attacker-specified credentials. Recommendations: For Jenkins Publish Over FTP...

CVE-2022-28155

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2022-28159

Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-28156

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace...

CVE-2022-28157

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server...

CVE-2022-28149

Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-28146

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps...

CVE-2022-28137

A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...

CVE-2022-28133

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to create BitBucket Server consumers...

CVE-2022-28135

Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

PT-2022-18853 · Jenkins · Jenkins Coverage/Complexity Scatter Plot Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Coverage/Complexity Scatter Plot Plugin versions 1.1.1 and earlier Description: The issue allows attackers to control input files for the 'Public Coverage / Complexity Scatter Plot' post-build step, enabling them to have Jenkins parse...

PT-2022-18849 · Jenkins · Jenkins Job/Node Ownership Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Job and Node ownership Plugin versions 0.13.0 and earlier Description: A cross-site request forgery CSRF vulnerability exists due to the lack of permission checks in several HTTP endpoints, allowing attackers with Item/Read permission...

PT-2022-18848 · Jenkins · Jenkins Job/Node Ownership Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Job and Node ownership Plugin versions 0.13.0 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the names of the secondary owners are not properly escaped, allowing...

Passwords stored in plain text by instant-messaging

instant-messaging provides a framework for plugins integrating Jenkins with instant messaging services. instant-messaging 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on instant-messaging on the Jenkins controller. These passwords...

Arbitrary file read vulnerability in ci-with-toad-edge

ci-with-toad-edge 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps. ci-with-toad-edge 2.4 only allows copying files from the node the build is...

Jenkins Extended Choice Parameter Plugin任意文件读取漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Extended Choice Parameter Plugin...