Jenkins plugins Multiple Vulnerabilities (2025-10-29)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with...

au.com.versent.jenkins.plugins:ignore-committer-strategy (>=37.v0d3157c4a_ef8 <=57.v0756db_b_f6926), com.coravy.hudson.plugins.github:github (>=1.41.0 <=1.45.0) +35 more potentially affected by CVE-2025-58458 via org.jenkins-ci.plugins:git-client (>=6.1.0 <=6.3.0)

org.jenkins-ci.plugins:git-client MAVEN version =6.1.0, =37.v0d3157c4aef8, =1.41.0, =61.vf6d8f6f5ed02, =1.1.0.825.v30618768da42, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =3.2083.vd36f32376929, =530.v38d502df428f, =634.v371dc6d978a3, =718.v40b5f0e67cd3,...

org.jenkins-ci.plugins:build-metrics (>=1.0 <=1.3) potentially affected by CVE-2025-58459 via org.jenkins-ci.plugins:global-build-stats (=1.2)

org.jenkins-ci.plugins:global-build-stats MAVEN version =1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:global-build-stats and may be impacted: - org.jenkins-ci.plugins:build-metrics =1.0, =1.3 Source cves: CVE-2025-58459...

Jenkins plugins Multiple Vulnerabilities (2025-07-09)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller,...

au.com.versent.jenkins.plugins:ignore-committer-strategy (>=29.v7c3891a_434c3 <=57.v0756db_b_f6926), com.amazon.jenkins.fleet:ec2-fleet (>=1.0 <=4.2.1.515.v100267825939) +109 more potentially affected by CVE-2025-53650 via org.jenkins-ci.plugins:credentials-binding (>=1.10 <=687.v619cb_15e923f)

org.jenkins-ci.plugins:credentials-binding MAVEN version =1.10, =29.v7c3891a434c3, =1.0, =1.6, =1.4, =1.41.0, =377.vc87a13718939, =57.vde5161ec7aba, =0.17, =60.vce1b19770361, =1.0.43, =1.0.0, =1.27.25 and more Source cves: CVE-2025-53650 Source advisory: OSV:GHSA-9768-HPRV-CRJ5...

Jenkins plugins Multiple Vulnerabilities (2025-05-14)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Critical In WSO2 Oauth Plugin 1.0 and earlier authentication claims are accepted without validation by the WSO2 Oauth security realm. This...

RHEL 8 : Red Hat Product OCP Tools 4.13 Openshift Jenkins (RHSA-2025:2222)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2222 advisory. Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cro...

Jenkins plugins Multiple Vulnerabilities (2025-01-22)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins OpenId Connect Authentication Plugin 4.452.v2849bd3945fa and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as...

Jenkins plugins Multiple Vulnerabilities (2024-11-27)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string. CVE-2024-47855 - Jenkins Simple Queue Plugin 1.4.4...

au.com.versent.jenkins.plugins:ignore-committer-strategy (=29.v7c3891a_434c3), com.amadeus.jenkins.plugins:workflow-cps-global-lib-http (>=2.33.0 <=2.54.0) +118 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1 <=3975.v567e2a_1ffa_22)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =2.33.0, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0, =1.0, =1.20 - de.taimos:pipeline-deploymon =1.0 and more Source cves: CVE-2024-52550 Source advisory: OSV:GHSA-MRPR-VR82-X88R...

org.jenkins-ci.plugins:role-strategy (=675.va_5f27678f6d6) potentially affected by CVE-2024-52552 via org.jenkins-ci.plugins:authorize-project (=1.7.0)

org.jenkins-ci.plugins:authorize-project MAVEN version =1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:authorize-project and may be impacted: - org.jenkins-ci.plugins:role-strategy =675.va5f27678f6d6 Source cves:...

Jenkins plugins Multiple Vulnerabilities (2024-11-13)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va3bb89f8a95b and 1362.1364.v4cf2dc5d8776, does not perform...

RHSA-2020:4265 Red Hat Security Advisory: OpenShift Container Platform 4.3.40 jenkins-2-plugins security update

Bulletin has no description...

org.jenkins-ci.plugins:bitbucket-approval-filter (=1.0.0), org.jenkins-ci.plugins:bitbucket-filter-project-trait (=1.0) +1 more potentially affected by CVE-2024-39460 via org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (>=2.2.0 <=2.4.1)

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source MAVEN version =2.2.0, =1.0.0, =1.0.2 Source cves: CVE-2024-39460 Source advisory: OSV:GHSA-X8MF-JCMF-R79F...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (=0.0.6), com.adq.jenkins:xml-job-to-job-dsl (>=0.1.1 <=0.1.13) +534 more potentially affected by CVE-2024-39458 via org.jenkins-ci.plugins:structs (>=1.1 <=337.v1b_04ea_4df7c8)

org.jenkins-ci.plugins:structs MAVEN version =1.1, =0.1.1, =2.33.0, =1.9.0, =2.0.1, =2.8, =2.0.12, =1.12, =1.225.v14f9e6b28f53, =1.0.2, =1.28.0, =0.6, =2.37.0, =1.0.0, =1.2.7, =1.3.2 and more Source cves: CVE-2024-39458 Source advisory: OSV:GHSA-XFX3-CR74-X3CV...

RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3198)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3198 advisory. Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cro...

com.seitenbau.jenkins.plugins:dynamicparameter (=0.2.0), org.biouno:uno-choice (>=1.0 <=1.5.3-alpha) potentially affected by CVE-2023-50765 via org.jenkins-ci.plugins:scriptler (>=2.2 <=2.9)

org.jenkins-ci.plugins:scriptler MAVEN version =2.2, =1.0, =1.5.3-alpha Source cves: CVE-2023-50765 Source advisory: OSV:GHSA-4J42-6XFX-H754...

com.base2services.jenkins:github-sqs-plugin (>=1.0 <=1.5), com.elasticbox.jenkins-ci.plugins:elasticbox (>=4.0.9 <=4.1.6) +24 more potentially affected by CVE-2023-46650 via com.coravy.hudson.plugins.github:github (>=1.10 <=1.3)

com.coravy.hudson.plugins.github:github MAVEN version =1.10, =1.0, =4.0.9, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =1.0.0, =1.0.0, =1.0-alpha-8, =1.0-alpha-4, =0.1-preview-4, =1.0-alpha-1, =1.3.0, =1.0, =0.9.14, =1.36.0, =1.42.2 and more Source cves: CVE-2023-46650 Source advisory:...

Jenkins plugins Multiple Vulnerabilities (2023-10-25)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - High GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes. This results in a stor...

com.lookout.jenkins:environment-script (=1.2.5), org.jenkins-ci.plugins:artifactory (>=2.12.0 <=2.12.1) +1 more potentially affected by CVE-2023-41938 via org.jenkins-ci.plugins:ivy (>=1.17 <=1.26)

org.jenkins-ci.plugins:ivy MAVEN version =1.17, =2.12.0, =0.6, =0.8 Source cves: CVE-2023-41938 Source advisory: OSV:GHSA-63VW-RPRV-4F8J...