24276 matches found
CVE-2025-64140
CVE-2025-64140 concerns Jenkins Azure CLI Plugin versions 0.9 and earlier. The root cause is that the plugin does not restrict which commands it can execute on the Jenkins controller, enabling an attacker with Item/Configure permission to run arbitrary shell commands. Reported impacts include ful...
CVE-2025-64139
A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...
CVE-2025-64139
A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...
CVE-2025-64140
Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands...
CVE-2025-64138
The CVE-2025-64138 entry concerns Jenkins Start Windocks Containers Plugin (versions 1.4 and earlier). The issue is a CSRF vulnerability in an HTTP endpoint that allows attackers with Overall/Read permission to trigger connections to an attacker-specified URL, even without POST requests. Multiple...
CVE-2025-64138
A cross-site request forgery CSRF vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL...
CVE-2025-64138
A cross-site request forgery CSRF vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL...
CVE-2025-64137
CVE-2025-64137 affects the Jenkins Themis Plugin (versions 1.4.1 and earlier). The issue is a missing permission check in an HTTP endpoint, which allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server. Public references in Red Hat and GitHub advisories reite...
CVE-2025-64137
A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server...
CVE-2025-64137
A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server...
CVE-2025-64135
The CVE-2025-64135 entry concerns Jenkins Eggplant Runner Plugin (versions up to 0.0.1.301.v963cffe8ddb_8 and earlier). The vulnerability arises from the Java system property jdk.http.auth.tunneling.disabledSchemes being set to an empty value during proxy configuration, which disables a Java runt...
CVE-2025-64135
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb8 and earlier sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value, disabling a protection mechanism of the Java runtime...
CVE-2025-64136
A cross-site request forgery CSRF vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server...
CVE-2025-64135
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb8 and earlier sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value, disabling a protection mechanism of the Java runtime...
CVE-2025-64136
A cross-site request forgery CSRF vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server...
CVE-2025-64136
The vulnerability CVE-2025-64136 affects Jenkins Themis Plugin versions 1.4.1 and earlier. Root cause: a cross-site request forgery (CSRF) flaw due to lack of permission checks in an HTTP endpoint, allowing an attacker with Overall/Read permission to trigger requests to an attacker-specified URL/...
CVE-2025-64133
A cross-site request forgery CSRF vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code...
CVE-2025-64133
A cross-site request forgery CSRF vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code...
CVE-2025-64134
CVE-2025-64134 affects the Jenkins JDepend Plugin (versions 1.3.1 and earlier) which embeds an outdated JDepend Maven Plugin that does not configure its XML parser to prevent XML External Entity (XXE) attacks. Reports and advisories describe XXE injection via crafted files in the JDepend Report s...