Vulnerabilities (CVE)

Vendor filter

Jenkins Subscribe

Product filter

Jenkins Subscribe

Filter

127 total CVE
CVE Vendors Products Updated CVSS
CVE-2013-2033 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2018-12-06 2.1
Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with write permission to inject arbitrary web script or...
CVE-2013-0158 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2018-10-30 2.6
Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers...
CVE-2012-6073 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2018-10-30 5.8
Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to redirect users to arbitrary web...
CVE-2012-0324 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2018-10-30 4.3
Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via...
CVE-2012-0325 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2018-10-30 4.3
Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via...
CVE-2012-6074 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2018-10-30 3.5
Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write...
CVE-2012-6072 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2018-10-30 4.3
CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers...
CVE-2018-1999045 1 Jenkins 1 Jenkins 2018-10-29 5.5
A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled.
CVE-2018-1999047 1 Jenkins 1 Jenkins 2018-10-26 4.0
A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers to cancel a Jenkins restart scheduled through the update center.
CVE-2018-1999043 1 Jenkins 1 Jenkins 2018-10-26 5.0
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.java that allows attackers to create ephemeral in-memory user records by attempting to...
CVE-2018-1999042 1 Jenkins 1 Jenkins 2018-10-26 5.0
A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.
CVE-2018-1999046 1 Jenkins 1 Jenkins 2018-10-16 4.0
A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attackers With Overall/Read permission to access the connection log for any agent.
CVE-2018-1999044 1 Jenkins 1 Jenkins 2018-10-16 4.0
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
CVE-2018-1999006 1 Jenkins 1 Jenkins 2018-09-27 4.0
A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackers to determine the date and time when a plugin HPI/JPI file was last extracted, which typically is the...
CVE-2018-1999005 1 Jenkins 1 Jenkins 2018-09-19 3.5
A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidget/control.jelly that allows attackers with Job/Configure permission to define JavaScript that would be...
CVE-2018-1999007 1 Jenkins 1 Jenkins 2018-09-19 3.5
A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins...
CVE-2018-1999001 1 Jenkins 1 Jenkins 2018-09-18 4.3
A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allows attackers to provide crafted login credentials that cause Jenkins to move the config.xml file from the...
CVE-2018-1999004 1 Jenkins 1 Jenkins 2018-09-18 4.0
A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches.
CVE-2018-1999003 1 Jenkins 1 Jenkins 2018-09-18 4.0
A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permission to cancel queued builds.
CVE-2018-1999002 1 Jenkins 1 Jenkins 2018-09-18 5.0
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on...