Information disclosure

A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

Jenkins SWAMP Plugin Cross-Site Request Forgery Vulnerability

Jenkins plug-ins are plug-ins that provide appropriate functionality for Jenkins. Jenkins SWAMP Plugin cross-site request forgery vulnerability. An attacker with general or read privileges can exploit this vulnerability to connect to a specified URL using a specified credential ID to capture...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set...

CVE-2021-21694

FilePathtoURI, FilePathhasSymlink, FilePathabsolutize, FilePathisDescendant, and FilePathgetDiskSpace do not check any permissions in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier...

CVE-2021-21688

The agent-to-controller security check FilePathreadingFileVisitor in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allowing users to have unrestricted read access using certain operations creating archives, FilePathcopyRecursiveTo...

CVE-2021-21694

An incorrect permissions validation vulnerability was found in Jenkins. The FilePathtoURI, FilePathhasSymlink, FilePathabsolutize, FilePathisDescendant, and FilePathgetDiskSpace do not check any permissions, which may allow an attacker who has access to any of these operations to be able to read...

Information disclosure

A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the list of pending requests...

Unauthorized Access Vulnerability in Jenkins

Jenkins is an independent open source software project , is based on Java development of a continuous integration tool . Jenkins has an unauthorized access vulnerability that can be exploited by attackers to obtain sensitive information...

CVE-2021-21638

A cross-site request forgery CSRF vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2021-21629

A cross-site request forgery CSRF vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a project with attacker-specified parameters...

CloudBees Jenkins TOCTOU Competitive Conditions Vulnerability

Jenkins is an open source continuous integration tool written in Java , mainly used for continuous , automated build/test software projects , monitor the operation of external tasks . A TOCTOU competitive condition vulnerability exists in Jenkins 2.275, LTS 2.263.2. An attacker can exploit this...

[ASA-202101-41] jenkins: multiple issues

Arch Linux Security Advisory ASA-202101-41 ========================================== Severity: High Date : 2021-01-20 CVE-ID : CVE-2021-21602 CVE-2021-21603 CVE-2021-21604 CVE-2021-21605 CVE-2021-21606 CVE-2021-21607 CVE-2021-21608 CVE-2021-21609 CVE-2021-21610 CVE-2021-21611 Package : jenkins...

jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks

A flaw was found in the mercurial plugin in Jenkins. The XML changelog parser is not configured to prevent an XML external entity XXE attack allowing an attacker the ability to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of...

Cross-site Scripting (XSS)

jenkins is vulnerable to cross-site scripting XSS. The vulnerability exists as it does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter...

Cross-Site Scripting (XSS)

Jenkins is vulnerable to cross-site scripting. The vulnerability existed because it does not escape display names and IDs of item types shown on the New Item page...

Cross-site Scripting (XSS)

jenkins is vulnerable to cross-site scripting XSS. The vulnerability exists as it does not escape TICS service responses...

CVE-2021-21602

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks...

Path traversal

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path...

CVE-2021-21606

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path...

CVE-2021-21602

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks...