Jenkins <=2.218 - Information Disclosure

Jenkins through 2.218, LTS 2.204.1 and earlier, is susceptible to information disclosure. An attacker can access exposed session identifiers on a user detail object in the whoAmI diagnostic page and thus potentially access sensitive information, modify data, and/or execute unauthorized operations...

Jenkins Git <=4.11.3 - Missing Authorization

Jenkins Git plugin through 4.11.3 contains a missing authorization check. An attacker can trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit. This can make it possible to obtain sensitive information, modify...

Jenkins build-metrics 1.3 - Cross-Site Scripting

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...

CVE-2024-23897

Using the client The general syntax for invoking the client is as follows: java -jar jenkins-cli.jar -s JENKINSURL global options... command command options... arguments... info :- https://www.jenkins.io/doc/book/managing/cli/downloading-the-client CVE :-...

zaproxy

The Zed Attack Proxy ZAP by Checkmarx is the world’s most widely used web app scanner. Free and open source. A community based GitHub Top 1000 project that anyone can contribute to. It can help you automatically find security vulnerabilities in your we...

cicd-goat

Deliberately vulnerable CI/CD environment. Hack CI/CD pipelines, capture the flags. 🚩 Created by Cider Security Acquired by Palo Alto Networks. Table of Contents Description Download & Run Linux & Mac Windows Powershell Usage Instructions Take the challenge Troubleshooting Solutions Contributing...

PoC-Fix-jenkins-rce_CVE-2024-23897

PoC-jenkins-rceCVE-2024-23897. On this git you can find all information on the CVE-2024-23897. Introduction The issue, assigned the CVE identifier CVE-2024-23897, has been described as an arbitrary file read vulnerability through the built-in command line interface. This command parser has a...

CVE-2024-52550

CVE-2024-52550 CVE-2024-52550 jenkins tester or PoC...

cred_scanner

credscanner A simple command line tool for finding AWS credentials in files. Optimized for use with Jenkins and other CI systems. I suspect there are other, better tools out there such as git-secrets, but I couldn't find anything to run a quick and dirty scan that also integrates well with Jenkin...

CVE-2024-23897

CVE-2024-23897 | Jenkins -p -f or python CVE-2024-23897.py -i -f Parameters: -t or --target: Specify the target IPs. Supports single IP, IP range, comma-separated list, or CIDR block. -i or --input-file: Path to input file containing hosts in the format of http://1.2.3.4:8080/ one per line. -o or...

Jenkins <=2.196 - Cookie Exposure

Jenkins through 2.196, LTS 2.176.3 and earlier prints the value of the cookie on the /whoAmI/ URL despite it being marked HttpOnly, thus making it possible to steal cookie-based authentication credentials if the URL is exposed or accessed via another cross-site scripting issue. id: CVE-2019-10405...

CVE-2024-23897

CVE-2024-23897: Jenkins Arbitrary File Read Vulnerability Leading to RCE Introduction This repository contains a Python script that exploits a critical vulnerability CVE-2024-23897 in Jenkins, leading to arbitrary file read and remote code execution RCE. This vulnerability allows an unauthenticat...

CVE-2026-53435

CVE-2026-53435 — Jenkins Deserialization → Arbitrary File Read PoC First public proof-of-concept for CVE-2026-53435, built when only the advisory existed and no PoC was published anywhere. Reconstructed from a vague one-line advisory over 8.5 hours on a Friday night — not by writing the exploit b...

CVE-2019-1003000_RCE-DETECTION

CVE-2019-1003000RCE-DETECTION General Summary Chaining vulnerability CVE-2018-1000861 with CVE-2019-1003000, I created a module to test for a Pre-Auth RCE on Jenkins CI. Initially, I had tried to go about detecting the vulnerability with a username and password and job name; however, I thought it...

CVE-2016-0792

Exploit for Jenkins serialization vulnerability - CVE-2016-0792 https://www.exploit-db.com/exploits/42394/ More information can be found here 1. Contrast Security 2. Pentester Lab Requirements 1. Python 3.6.x 2. requests library is required for this exploit to work sudo pip install requests Usage...

Jenkins-CVE-2024-23897

Jenkins CVE-2024-23897 PoC A proof-of-concept PoC for CVE-2024-23897, an arbitrary file read vulnerability in Jenkins' built-in command line interface CLI. It allows unauthenticated attackers with Overall/Read permission to read arbitrary files on the Jenkins controller file system. Affected...

CVE-2026-117626

A flaw was found in Jenkins. The file browser for workspaces and user content fails to properly validate file paths, resulting in a path traversal vulnerability. An authenticated attacker with read or workspace permissions can exploit this flaw by submitting crafted requests to obtain sensitive...

CVE-2026-117624

A flaw was found in Jenkins. The application fails to consistently enforce restrictions against deserializing certain object types as nested values when those types are designated only for top-level configuration files. An attacker can exploit this flaw by submitting crafted configuration data to...

CVE-2026-117623

A flaw was found in Jenkins. A stored cross-site scripting XSS vulnerability exists because the application does not properly sanitize text displayed in breadcrumb bar overflow menu tooltips. An authenticated user with read permissions can exploit this issue by injecting malicious script code. Wh...

CVE-2026-117622

A flaw was found in Jenkins. An attacker in control of an agent process can exploit a cross-site scripting XSS vulnerability on the controller. By transmitting crafted exceptions that implement the HTTP response interface to the controller, malicious content is served to users accessing the...