Lucene search
+L
JenkinsMost viewed

1537 matches found

Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2019/04/30 12:00 a.m.โ€ข12 views

XXE vulnerability via UDP broadcast response in swarm client

swarm allows clients to auto-discover Jenkins instances on the same network through a UDP discovery request. Responses to this request are XML documents. swarm does not configure the XML parser in a way that would prevent XML External Entity XXE processing. This allows unauthenticated attackers o...

9.3CVSS7.8AI score0.01794EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2019/04/03 12:00 a.m.โ€ข12 views

VS Team Services Continuous Deployment Plugin stores credentials in plain text

vsts-cd stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

8.8CVSS6.3AI score0.0134EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2019/04/03 12:00 a.m.โ€ข12 views

relution-publisher stores credentials in plain text

relution-publisher stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.relutionpublisher.configuration.global.StoreConfiguration.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

8.8CVSS6.2AI score0.0174EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2019/04/03 12:00 a.m.โ€ข12 views

CloudShare Docker-Machine Plugin stores credentials in plain text

CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file com.cloudshare.jenkins.CloudShareConfiguration.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

8.8CVSS6.2AI score0.01352EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2019/04/03 12:00 a.m.โ€ข12 views

cloudcoreo-deploytime stores credentials in plain text

cloudcoreo-deploytime stores credentials unencrypted in its global configuration file com.cloudcoreo.plugins.jenkins.CloudCoreoBuildWrapper.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

8.8CVSS6.2AI score0.0174EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2019/03/25 12:00 a.m.โ€ข12 views

SSRF vulnerability due to missing permission check in Fortify on Demand Uploader Plugin

A missing permission check in multiple form validation methods in Fortify on Demand Uploader Plugin allowed users with Overall/Read permission to initiate a connection test to an attacker-specified server. Additionally, the form validation methods did not require POST requests, resulting in a CSR...

6.5CVSS6.4AI score0.01508EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2019/03/06 12:00 a.m.โ€ข12 views

Script security sandbox bypass in Job DSL Plugin

Job DSL Plugin supports sandboxed Groovy expressions for Job DSL definitions. Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script. This allowed users able to control the Job DSL scripts to bypass the sandbox...

9.9CVSS8.8AI score0.02962EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2018/10/10 12:00 a.m.โ€ข12 views

Arbitrary file write vulnerability using file parameter definitions

Users with Job/Configure permission could specify a relative path escaping the base directory in the file name portion of a file parameter definition. This path would be used to archive the uploaded file on the Jenkins controller, resulting in an arbitrary file write vulnerability. File parameter...

6.5CVSS6.7AI score0.04021EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2018/08/15 12:00 a.m.โ€ข12 views

Unauthorized users could cancel scheduled restarts initiated from the update center

Users with Overall/Read permission were able to access the URL used to cancel scheduled restart jobs initiated via the update center "Restart Jenkins when installation is complete and no jobs are running" due to a lack of permission checks. Access to the affected URL is now limited to users with...

6.5CVSS6.6AI score0.00774EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2018/08/15 12:00 a.m.โ€ข12 views

"Remember me" cookie was evaluated even if that feature is disabled

The "Remember me" feature can be disabled in the Jenkins security configuration. This did not disable the processing of previously set "Remember me" cookies, so they still allowed users to be logged in. "Remember me" cookies are no longer evaluated when the corresponding feature is disabled...

5.5CVSS6AI score0.00874EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2018/07/18 12:00 a.m.โ€ข12 views

XSS vulnerability in Stapler debug mode

Stapler is the web framework used by Jenkins to route HTTP requests. When its debug mode is enabled, HTTP 404 error pages display diagnostic information. Those error pages did not escape parts of URLs they displayed, in rare cases resulting in a cross-site scripting vulnerability. Parts of URLs...

5.4CVSS5.3AI score0.00894EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2018/06/25 12:00 a.m.โ€ข12 views

Server-side request forgery vulnerability in URLTrigger Plugin

A form validation method in URLTrigger Plugin did not check the permission of the user accessing them, allowing anyone with Overall/Read access to Jenkins to cause Jenkins to send a GET request to a specified URL. Additionally, this form validation method did not require POST requests, resulting ...

6.5CVSS6.4AI score0.007EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2018/06/04 12:00 a.m.โ€ข12 views

Server-side request forgery vulnerability in Git Plugin

Various form validation methods in Git Plugin did not check the permission of the user accessing them, allowing anyone with Overall/Read access to Jenkins to cause Jenkins to send a GET request to a specified URL. Additionally, these form validation methods did not require POST requests, resultin...

6.4CVSS6.9AI score0.00809EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2018/05/09 12:00 a.m.โ€ข12 views

Path traversal vulnerability in agent to controller security subsystem

The agent to controller security subsystem ensures that the Jenkins controller is protected from maliciously configured agents. Learn more. A path traversal vulnerability allowed agents to escape whitelisted directories to read and write to files they should not be able to access. Paths are now...

8.1CVSS7.5AI score0.02612EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2026/09/16 12:00 a.m.โ€ข11 views

Path traversal vulnerability in pipeline-groovy-lib

pipeline-groovy-lib provides the library step to retrieve a shared library from an SCM, using a library path to specify the directory containing the library inside the SCM checkout. pipeline-groovy-lib 805.vafc79344957d and earlier does not restrict that library path to a relative path inside the...

4.2CVSS5.7AI score0.00229EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2026/09/02 12:00 a.m.โ€ข11 views

Path traversal vulnerability in file-parameters can lead to RCE

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor and binding submitted data to their arguments. file-parameters validates...

8.8CVSS6.2AI score0.00835EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2026/09/02 12:00 a.m.โ€ข11 views

Form submission data binding can set static fields

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of...

5.4CVSS5.8AI score0.00251EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2026/09/02 12:00 a.m.โ€ข11 views

Missing permission check allows reading build parameters

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not perform an Item/Read permission check in an HTTP endpoint. This allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to. Jenkins 2.580, LTS 2.568.3 performs a...

4.3CVSS5.8AI score0.00301EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2026/09/02 12:00 a.m.โ€ข11 views

Improper access control in customizable-header leads to XSS

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties...

8.8CVSS5.8AI score0.00509EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2026/09/02 12:00 a.m.โ€ข11 views

Cross-origin exposure of CSRF token

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler provides an HTTP endpoint serving dynamically generated JavaScript resources. In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6,...

8.8CVSS5.7AI score0.00201EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2026/09/02 12:00 a.m.โ€ข11 views

Deserialization of untrusted data vulnerability in performance

performance uses Java serialization to cache performance reports in the build directory. performance 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller. This...

8.8CVSS6.2AI score0.00638EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2026/09/02 12:00 a.m.โ€ข11 views

Unsafe deserialization allows overwriting configuration objects

In Jenkins, fields declared transient are excluded from serialization but are still read back during deserialization for backward compatibility with existing configuration files. In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization,...

8.8CVSS5.8AI score0.00468EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2026/09/02 12:00 a.m.โ€ข11 views

Injection vulnerability in REST API

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API. This allows attackers able to control map property names to inject arbitrary fields into JSON and Python API responses. Jenkins 2.580, LTS 2.568.3 escapes...

4.3CVSS5.9AI score0.00313EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2023/07/12 12:00 a.m.โ€ข11 views

Session fixation vulnerability in openshift-login

openshift-login 1.1.0.227.v27e08dfb1a20 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. openshift-login 1.1.0.230.v5d7030bf5432 invalidates the existing session on login...

8.8CVSS7.9AI score0.00833EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2023/01/24 12:00 a.m.โ€ข11 views

CSRF vulnerability and missing permission checks in jira-steps

jira-steps 2.0.165.v8846cf59f3db and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...

8.8CVSS6.9AI score0.00769EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2023/01/24 12:00 a.m.โ€ข11 views

Missing permission checks in cisco-spark-notifier allow enumerating credentials IDs

cisco-spark-notifier 1.1.1 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

4.3CVSS5AI score0.00584EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/12/07 12:00 a.m.โ€ข11 views

CSRF vulnerability in sonar-gerrit

sonar-gerrit 377.v8f3808963dc5 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This allows attackers to have Jenkins connect to Gerrit servers previously configured by Jenkins administrators using attacker-specified...

6.5CVSS6.4AI score0.00441EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/12/07 12:00 a.m.โ€ข11 views

Stored XSS vulnerability in custom-build-properties

custom-build-properties 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom Build Properties and Build Summary pages. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to set or change these values...

8CVSS5.4AI score0.00469EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/11/15 12:00 a.m.โ€ข11 views

Arbitrary file read vulnerability in pipeline-utility-steps

pipeline-utility-steps implements a readProperties Pipeline step that supports interpolation of variables using the Apache Commons Configuration library. pipeline-utility-steps 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of this library that...

8.1CVSS7.8AI score0.01416EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/11/15 12:00 a.m.โ€ข11 views

Whole-script approval in script-security vulnerable to SHA-1 collisions

script-security 1189.vbab7c8fd5fde and earlier stores whole-script approvals as the https://en.wikipedia.org/wiki/SHA-1SHA-1 hash of the approved script. SHA-1 no longer meets the security standards for producing a cryptographically secure message digest. script-security 1190.v65867aa47126 uses...

8CVSS7.5AI score0.00499EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/11/15 12:00 a.m.โ€ข11 views

XXE vulnerability on agents in sourcemonitor

sourcemonitor 0.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control XML input files for the 'Publish SourceMonitor results' post-build step to have agent processes parse a crafted file that uses external entities for...

9.8CVSS8.6AI score0.01024EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/09/21 12:00 a.m.โ€ข11 views

Missing permission checks in rundeck

rundeck 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints. This allows attackers with Item/Read permission to obtain information about build artifacts of a given job, if the optional Run/Artifacts permission is enabled. As of publication of this...

4.3CVSS5AI score0.00616EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/09/21 12:00 a.m.โ€ข11 views

CSRF vulnerability in security-inspector

security-inspector 117.v6eecc36919c2 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to replace the generated report stored in a per-session cache and displayed to authorized users a...

8.8CVSS7.8AI score0.00437EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/07/27 12:00 a.m.โ€ข11 views

CSRF vulnerability in external-monitor-job

external-monitor-job 191.v363d0d1efdf8 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to create runs of an external job. external-monitor-job 192.ve979ca8b3ccd requires POST request...

4.3CVSS4.9AI score0.00403EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/07/27 12:00 a.m.โ€ข11 views

Reflected XSS vulnerability in lucene-search

lucene-search 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the search result page. This results in a reflected cross-site scripting XSS vulnerability. As of publication of this advisory, there is no fix. Learn why we announce this...

8.8CVSS5.4AI score0.00694EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/07/27 12:00 a.m.โ€ข11 views

Missing permission check in rhnpush-plugin allows listing workspace contents

rhnpush-plugin 0.5.1 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A...

4.3CVSS5AI score0.00661EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/07/27 12:00 a.m.โ€ข11 views

Non-constant time webhook signature comparison in github

github 1.34.4 and earlier does not use a constant-time comparison when checking whether the provided and computed webhook signatures are equal. This could potentially allow attackers to use statistical methods to obtain a valid webhook signature. github 1.34.5 uses a constant-time comparison when...

5.3CVSS5.5AI score0.00895EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/07/27 12:00 a.m.โ€ข11 views

Missing permission check in buckminster

buckminster 1.1.1 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. A sequence of requests can be used to...

4.3CVSS5AI score0.00565EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/06/30 12:00 a.m.โ€ข11 views

Missing permission checks in ec2-deployment-dashboard allow enumerating credentials IDs

ec2-deployment-dashboard 1.0.10 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using anoth...

4.3CVSS5.1AI score0.00724EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/06/30 12:00 a.m.โ€ข11 views

Tokens stored in plain text by build-notifications

build-notifications 1.5.0 and earlier stores multiple tokens unencrypted in its global configuration files on the Jenkins controller as part of its configuration: Pushover Application Token in tools.devnull.jenkins.plugins.buildnotifications.PushoverNotifier.xml Slack Bot Token in...

4.3CVSS5AI score0.0059EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/06/30 12:00 a.m.โ€ข11 views

Token stored in plain text by cisco-spark

cisco-spark 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file org.jenkinsci.plugins.spark.SparkNotifier.xml on the Jenkins controller as part of its configuration. These bearer tokens can be viewed by users with access to the Jenkins controller file system. As of...

4.3CVSS5AI score0.0059EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/06/22 12:00 a.m.โ€ข11 views

Reflected XSS vulnerability in embeddable-build-status

embeddable-build-status 2.0.3 allows specifying a link query parameter that build status badges will link to, without restricting possible values. This results in a reflected cross-site scripting XSS vulnerability. embeddable-build-status 2.0.4 limits URLs to http and https protocols and correctl...

8.8CVSS5.8AI score0.00962EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/06/22 12:00 a.m.โ€ข11 views

Path traversal vulnerability in embeddable-build-status

embeddable-build-status 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values. This results in a relative path traversal vulnerability, allowing attackers without Overall/Read permission to specify paths ...

7.5CVSS7.3AI score0.01725EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/06/22 12:00 a.m.โ€ข11 views

Reflected XSS vulnerability in nested-view

nested-view 1.20 through 1.25 both inclusive does not escape search parameters. This results in a reflected cross-site scripting XSS vulnerability. nested-view 1.26 escapes search parameters...

8.8CVSS5.8AI score0.00962EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/05/17 12:00 a.m.โ€ข11 views

User-scoped credentials exposed to other users by blueocean-pipeline-scm-api

When pipelines are created using the pipeline creation wizard in Blue Ocean, the credentials used are stored in the per-user credentials store of the user creating the pipeline. To allow pipelines to use this credential to scan repositories and checkout from SCM, the Blue Ocean Credentials Provid...

6.5CVSS6.3AI score0.01008EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/05/17 12:00 a.m.โ€ข11 views

Missing permission check in gitlab-plugin allows enumerating credentials IDs

gitlab-plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability...

6.5CVSS6.4AI score0.00886EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/03/29 12:00 a.m.โ€ข11 views

Missing permission checks in Pipeline: Phoenix AutoTest allow enumerating credentials IDs

Pipeline: Phoenix AutoTest 1.3 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using anothe...

6.5CVSS6.4AI score0.00751EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/03/29 12:00 a.m.โ€ข11 views

Stored XSS vulnerability in selected-tests-executor

selected-tests-executor 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix...

8CVSS5.3AI score0.00824EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/03/29 12:00 a.m.โ€ข11 views

Passwords stored in plain text by instant-messaging

instant-messaging provides a framework for plugins integrating Jenkins with instant messaging services. instant-messaging 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on instant-messaging on the Jenkins controller. These passwords...

6.5CVSS6.4AI score0.00923EPSS
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
โ€ขadded 2022/03/15 12:00 a.m.โ€ข11 views

Arbitrary file read vulnerability in kubernetes-cd

kubernetes-cd contributes the 'Kubernetes configuration kubeconfig' credential type. kubernetes-cd 2.3.1 and earlier allows users with Credentials/Create or Credentials/Update permission to read arbitrary files on the Jenkins controller by defining a 'From a file on the Jenkins master' Kubeconfig...

6.5CVSS6.5AI score0.01835EPSS
SaveExploits0Affected Software1
Total number of security vulnerabilities1537