Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Jenkins Subscribe
Filtered by product Jenkins
Total 233 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-27902 1 Jenkins 1 Jenkins 2023-03-16 N/A 4.3 MEDIUM
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their contents.
CVE-2023-27901 1 Jenkins 1 Jenkins 2023-03-16 N/A 7.5 HIGH
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service.
CVE-2023-27900 1 Jenkins 1 Jenkins 2023-03-16 N/A 7.5 HIGH
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.
CVE-2023-27899 1 Jenkins 1 Jenkins 2023-03-16 N/A 7.0 HIGH
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a plugin for installation, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used, potentially resulting in arbitrary code execution.
CVE-2023-27898 1 Jenkins 1 Jenkins 2023-03-16 N/A 5.4 MEDIUM
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
CVE-2023-27903 1 Jenkins 1 Jenkins 2023-03-15 N/A 4.4 MEDIUM
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used.
CVE-2023-27904 1 Jenkins 1 Jenkins 2023-03-15 N/A 5.3 MEDIUM
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.
CVE-2019-10406 1 Jenkins 1 Jenkins 2023-02-22 3.5 LOW 4.8 MEDIUM
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.
CVE-2019-10405 1 Jenkins 1 Jenkins 2023-02-22 3.5 LOW 5.4 MEDIUM
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
CVE-2019-10403 1 Jenkins 1 Jenkins 2023-02-22 3.5 LOW 5.4 MEDIUM
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
CVE-2019-10404 1 Jenkins 1 Jenkins 2023-02-22 3.5 LOW 5.4 MEDIUM
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored XSS vulnerability exploitable by users able to control parts of the reason a queue item is blocked, such as label expressions not matching any idle executors.
CVE-2019-10402 1 Jenkins 1 Jenkins 2023-02-22 3.5 LOW 5.4 MEDIUM
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents.
CVE-2013-2033 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2023-02-12 2.1 LOW N/A
Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with write permission to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-0327 1 Jenkins 1 Jenkins 2023-02-12 6.8 MEDIUM N/A
Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.
CVE-2013-0329 1 Jenkins 1 Jenkins 2023-02-12 7.5 HIGH N/A
Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors.
CVE-2013-0328 1 Jenkins 1 Jenkins 2023-02-12 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-6074 2 Cloudbees, Jenkins 2 Jenkins, Jenkins 2023-02-12 3.5 LOW N/A
Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-3662 2 Jenkins, Redhat 2 Jenkins, Openshift 2023-02-12 5.0 MEDIUM N/A
Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts.
CVE-2014-3665 1 Jenkins 1 Jenkins 2023-02-12 6.8 MEDIUM N/A
Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by leveraging access to the slave.
CVE-2014-3680 2 Jenkins, Redhat 2 Jenkins, Openshift 2023-02-12 4.0 MEDIUM N/A
Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized job by reading the DOM.