org.jenkins-ci.main:jenkins-test-harness (1.408), org.jenkins-ci.main:jenkins-war (1.408) +11 more potentially affected by CVE-2022-20612 via org.jenkins-ci.main:jenkins-core (1.408)

org.jenkins-ci.main:jenkins-core MAVEN version 1.408 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.408 - org.jenkins-ci.main:jenkins-war 1.408 -...

org.jenkins-ci.main:jenkins-test-harness (1.453), org.jenkins-ci.main:jenkins-war (1.453) +3 more potentially affected by CVE-2022-20612 via org.jenkins-ci.main:jenkins-core (1.453)

org.jenkins-ci.main:jenkins-core MAVEN version 1.453 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.453 - org.jenkins-ci.main:jenkins-war 1.453 -...

org.jenkins-ci.main:jenkins-test-harness (1.522), org.jenkins-ci.main:jenkins-war (1.522) +4 more potentially affected by CVE-2022-20612 via org.jenkins-ci.main:jenkins-core (1.522)

org.jenkins-ci.main:jenkins-core MAVEN version 1.522 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.522 - org.jenkins-ci.main:jenkins-war 1.522 -...

com.cisco.step.jenkins.plugins:jenkow-parent (0.1), org.jenkins-ci.main:jenkins-test-harness (1.455) +9 more potentially affected by CVE-2022-20612 via org.jenkins-ci.main:jenkins-core (1.455)

org.jenkins-ci.main:jenkins-core MAVEN version 1.455 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cisco.step.jenkins.plugins:jenkow-parent 0.1 - org.jenkins-ci.main:jenkins-test-harness 1.4...

org.jenkins-ci.main:jenkins-test-harness (1.456), org.jenkins-ci.main:jenkins-war (1.456) +6 more potentially affected by CVE-2022-20612 via org.jenkins-ci.main:jenkins-core (1.456)

org.jenkins-ci.main:jenkins-core MAVEN version 1.456 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.456 - org.jenkins-ci.main:jenkins-war 1.456 -...

CVE-2022-23115

Cross-site request forgery CSRF vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access to retrieve logs, build or delete a batch task...

CVE-2022-23109

Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed...

CVE-2022-23111

A cross-site request forgery CSRF vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials...

CVE-2022-23106

Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token...

CVE-2022-23114

Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2022-23105

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations...

PT-2022-15854 · Jenkins · Jenkins Publish Over Ssh Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Publish Over SSH Plugin versions 1.22 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials. Recommendations: For Jenkins...

Jenkins Plugin security vulnerabilities

Jenkins Plugin is an open source application for Jenkins. The Jenkins Plugin Conjur Secrets Plugin 1.0.9 previously contained a security vulnerability that allowed an attacker to exploit the vulnerability to take control of an agent process to retrieve the functionality of all username-password...

Jenkins Plugin: Permissions, Licensing, and Access Control Vulnerabilities

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Mailer Plugin 391.ve4a 38c1b cf4b and prior versions are vulnerable to a privilege error. The vulnerability stems...

Jenkins plugin: Operating system command injection vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. Jenkins Docker Commons...

Jenkins Plugin security vulnerabilities

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . Jenkins Publish Over SSH Plugin in 1.22 and earlier versions of the authorization problem vulnerability , the...

Jenkins Plugin: Permissions, Licensing, and Access Control Vulnerabilities

Jenkins Plugin is a Jenkins open source application. Jenkins Plugin Bitbucket suffers from a Permission Permission and Access Control Issues vulnerability that stems from a lack of permission checking that allows an attacker with aggregate/read access to enumerate the credential IDs of credential...

PT-2022-15855 · Jenkins · Jenkins Publish Over Ssh Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Publish Over SSH Plugin versions 1.22 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read access to connect to an attacker-specified SSH server using attacker-specified credentials...

PT-2022-15856 · Jenkins · Jenkins Publish Over Ssh Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Publish Over SSH Plugin versions 1.22 and earlier Description: The issue allows attackers with Item/Configure permission to discover the name of the Jenkins controller files due to a path traversal vulnerability. This occurs because t...

Agent-to-controller security bypass in conjur-credentials allows retrieving all credentials

conjur-credentials 1.0.9 and earlier implements functionality that allows agent processes to obtain all username/password credentials Credentials Plugin stored on the Jenkins controller. This allows attackers able to control agent processes to retrieve those credentials. As of publication of this...