Vulnerabilities (CVE)

Vendor filter

Jenkins Subscribe

Product filter

Jenkins Subscribe

Filter

138 total CVE
CVE Vendors Products Updated CVSS
CVE-2018-1000997 1 Jenkins 1 Jenkins 2019-02-14 4.0
A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java,...
CVE-2019-1003003 1 Jenkins 1 Jenkins 2019-02-13 6.5
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft...
CVE-2018-1000863 1 Jenkins 1 Jenkins 2019-02-04 6.4
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats,...
CVE-2018-1000861 1 Jenkins 1 Jenkins 2019-02-01 10.0
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java...
CVE-2018-1000862 1 Jenkins 1 Jenkins 2019-02-01 4.0
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds...
CVE-2018-1000864 1 Jenkins 1 Jenkins 2019-02-01 4.0
A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
CVE-2018-1000409 1 Jenkins 1 Jenkins 2019-01-30 5.8
A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that prevented Jenkins from invalidating the existing session and creating a new...
CVE-2018-1000408 1 Jenkins 1 Jenkins 2019-01-30 6.4
A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that allows attackers without Overall/Read permission to access a specific URL on...
CVE-2018-1000410 1 Jenkins 1 Jenkins 2019-01-30 2.1
An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java,...
CVE-2018-1000407 1 Jenkins 1 Jenkins 2019-01-28 4.3
A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled...
CVE-2018-1000406 1 Jenkins 1 Jenkins 2019-01-28 4.0
A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that allows attackers with Job/Configure permission to define a file parameter with a file name...
CVE-2014-3681 2 Jenkins, Redhat 2 Openshift, Jenkins 2018-12-18 4.3
Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-2033 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2018-12-06 2.1
Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with write permission to inject arbitrary web script or...
CVE-2012-6073 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2018-10-30 5.8
Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to redirect users to arbitrary web...
CVE-2012-6072 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2018-10-30 4.3
CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers...
CVE-2013-0158 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2018-10-30 2.6
Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers...
CVE-2012-0325 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2018-10-30 4.3
Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via...
CVE-2012-0324 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2018-10-30 4.3
Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via...
CVE-2012-6074 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2018-10-30 3.5
Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write...
CVE-2018-1999045 1 Jenkins 1 Jenkins 2018-10-29 5.5
A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled.