Vendor CVEs

Jenkins Project

All CVEs

1,922 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2022-34818	Jenkins Project Failed Job Deactivator	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs.
CVE-2022-34817	Jenkins Project Failed Job Deactivator	Med	0.28	4.3	0.00	Jun 30, 2022	A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs.
CVE-2022-34815	Jenkins Project Request Rename Or Delete	Med	0.28	4.3	0.00	Jun 30, 2022	A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, thereby renaming or deleting jobs.
CVE-2022-34814	Jenkins Project Request Rename Or Delete	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending requests.
CVE-2022-34813	Jenkins Project Xpath Configuration Viewer	Med	0.28	4.3	0.01	Jun 30, 2022	A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XPath expressions.
CVE-2022-34812	Jenkins Project Xpath Configuration Viewer	Med	0.28	4.3	0.00	Jun 30, 2022	A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath expressions.
CVE-2022-34811	Jenkins Project Xpath Configuration Viewer	Med	0.28	4.3	0.01	Jun 30, 2022	A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to access the XPath Configuration Viewer page.
CVE-2022-34808	Jenkins Project Cisco Spark	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34804	Jenkins Project Opsgenie	Med	0.28	4.3	0.00	Jun 30, 2022	Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure.
CVE-2022-34803	Jenkins Project Opsgenie	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission (config.xml), or access to the Jenkins controller file…
CVE-2022-34802	Jenkins Project Rocketchat Notifier	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34801	Jenkins Project Build Notifications	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2022-34800	Jenkins Project Build Notifications	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34799	Jenkins Project Deployment Dashboard	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34798	Jenkins Project Deployment Dashboard	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVE-2022-34797	Jenkins Project Deployment Dashboard	Med	0.28	4.3	0.01	Jun 30, 2022	A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVE-2022-34796	Jenkins Project Deployment Dashboard	Med	0.28	4.3	0.01	Jun 30, 2022	A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-34785	Jenkins Project build-metrics	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them.
CVE-2022-34782	Jenkins Project Requests	Med	0.28	4.3	0.01	Jun 30, 2022	An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests.
CVE-2022-34778	Jenkins Project Testng Results	Med	0.28	5.4	0.01	Jun 30, 2022	Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to…
CVE-2022-34208	Jenkins Project Beaker Builder	Med	0.28	4.3	0.01	Jun 23, 2022	A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-34206	Jenkins Project Jianliao Notification	Med	0.28	4.3	0.01	Jun 23, 2022	A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL.
CVE-2022-34204	Jenkins Project Easyqa	Med	0.28	4.3	0.01	Jun 23, 2022	A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
CVE-2022-34197	Jenkins Project Sauce Ondemand	Med	0.28	5.4	0.01	Jun 23, 2022	Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34191	Jenkins Project NS-ND Integration Performance Publisher Plugin	Med	0.28	5.4	0.01	Jun 23, 2022	Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34188	Jenkins Project Hidden Parameter	Med	0.28	5.4	0.01	Jun 23, 2022	Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34170	Jenkins Project Jenkins	Med	0.28	5.4	0.01	Jun 23, 2022	In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability…
CVE-2022-30957	Jenkins Project SSH	Med	0.28	4.3	0.01	May 17, 2022	A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-30949	Jenkins Project Repo	Med	0.28	5.3	0.01	May 17, 2022	Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
CVE-2022-29049	Jenkins Project Promoted Builds	Med	0.28	5.4	0.01	Apr 12, 2022	Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.
CVE-2022-29047	Jenkins Project Pipeline: Shared Groovy Libraries Plugin	Med	0.28	5.3	0.01	Apr 12, 2022	Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the…
CVE-2022-29044	Jenkins Project Node And Label Parameter	Med	0.28	5.4	0.01	Apr 12, 2022	Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-29043	Jenkins Project Mask Passwords	Med	0.28	5.4	0.01	Apr 12, 2022	Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-29041	Jenkins Project Jira	Med	0.28	5.4	0.01	Apr 12, 2022	Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with…
CVE-2022-29039	Jenkins Project Gerrit Trigger	Med	0.28	5.4	0.01	Apr 12, 2022	Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-29037	Jenkins Project Cvs	Med	0.28	5.4	0.01	Apr 12, 2022	Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-28152	Jenkins Project Job And Node Ownership	Med	0.28	4.3	0.01	Mar 29, 2022	A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore the default ownership of a job.
CVE-2022-28151	Jenkins Project Job And Node Ownership	Med	0.28	4.3	0.01	Mar 29, 2022	A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change the owners and item-specific permissions of a job.
CVE-2022-28145	Jenkins Project Continuous Integration With Toad Edge	Med	0.28	5.4	0.01	Mar 29, 2022	Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a stored cross-site scripting (XSS) exploitable by attackers with Item/Configure permission or otherwise able to control…
CVE-2022-28138	Jenkins Project Rocketchat Notifier	Med	0.28	4.3	0.01	Mar 29, 2022	A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credential.
CVE-2022-27218	Jenkins Project Incapptic Connect Uploader	Med	0.28	4.3	0.01	Mar 15, 2022	Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVE-2022-27215	Jenkins Project Release Helper	Med	0.28	4.3	0.01	Mar 15, 2022	A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2022-27214	Jenkins Project Release Helper	Med	0.28	4.3	0.00	Mar 15, 2022	A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2022-27205	Jenkins Project Extended Choice Parameter	Med	0.28	4.3	0.01	Mar 15, 2022	A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-27199	Jenkins Project Cloudbees AWS Credentials	Med	0.28	4.3	0.01	Mar 15, 2022	A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.
CVE-2022-27197	Jenkins Project Dashboard View	Med	0.28	5.4	0.01	Mar 15, 2022	Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.
CVE-2022-27196	Jenkins Project Favorite	Med	0.28	5.4	0.01	Mar 15, 2022	Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.
CVE-2022-25191	Jenkins Project Agent Server Parameter	Med	0.28	5.4	0.01	Feb 15, 2022	Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-25189	Jenkins Project Custom Checkbox Parameter	Med	0.28	5.4	0.01	Feb 15, 2022	Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-25185	Jenkins Project Generic Webhook Trigger	Med	0.28	5.4	0.01	Feb 15, 2022	Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CVE-2022-34818MedJun 30, 2022
Jenkins Project
Failed Job Deactivator
risk 0.28cvss 4.3epss 0.01
Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs.
CVE-2022-34817MedJun 30, 2022
Jenkins Project
Failed Job Deactivator
risk 0.28cvss 4.3epss 0.00
A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs.
CVE-2022-34815MedJun 30, 2022
Jenkins Project
Request Rename Or Delete
risk 0.28cvss 4.3epss 0.00
A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, thereby renaming or deleting jobs.
CVE-2022-34814MedJun 30, 2022
Jenkins Project
Request Rename Or Delete
risk 0.28cvss 4.3epss 0.01
Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending requests.
CVE-2022-34813MedJun 30, 2022
Jenkins Project
Xpath Configuration Viewer
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XPath expressions.
CVE-2022-34812MedJun 30, 2022
Jenkins Project
Xpath Configuration Viewer
risk 0.28cvss 4.3epss 0.00
A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath expressions.
CVE-2022-34811MedJun 30, 2022
Jenkins Project
Xpath Configuration Viewer
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to access the XPath Configuration Viewer page.
CVE-2022-34808MedJun 30, 2022
Jenkins Project
Cisco Spark
risk 0.28cvss 4.3epss 0.01
Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34804MedJun 30, 2022
Jenkins Project
Opsgenie
risk 0.28cvss 4.3epss 0.00
Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure.
CVE-2022-34803MedJun 30, 2022
Jenkins Project
Opsgenie
risk 0.28cvss 4.3epss 0.01
Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission (config.xml), or access to the Jenkins controller file…
CVE-2022-34802MedJun 30, 2022
Jenkins Project
Rocketchat Notifier
risk 0.28cvss 4.3epss 0.01
Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34801MedJun 30, 2022
Jenkins Project
Build Notifications
risk 0.28cvss 4.3epss 0.01
Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2022-34800MedJun 30, 2022
Jenkins Project
Build Notifications
risk 0.28cvss 4.3epss 0.01
Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34799MedJun 30, 2022
Jenkins Project
Deployment Dashboard
risk 0.28cvss 4.3epss 0.01
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34798MedJun 30, 2022
Jenkins Project
Deployment Dashboard
risk 0.28cvss 4.3epss 0.01
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVE-2022-34797MedJun 30, 2022
Jenkins Project
Deployment Dashboard
risk 0.28cvss 4.3epss 0.01
A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVE-2022-34796MedJun 30, 2022
Jenkins Project
Deployment Dashboard
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-34785MedJun 30, 2022
Jenkins Project
build-metrics
risk 0.28cvss 4.3epss 0.01
Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them.
CVE-2022-34782MedJun 30, 2022
Jenkins Project
Requests
risk 0.28cvss 4.3epss 0.01
An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests.
CVE-2022-34778MedJun 30, 2022
Jenkins Project
Testng Results
risk 0.28cvss 5.4epss 0.01
Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to…
CVE-2022-34208MedJun 23, 2022
Jenkins Project
Beaker Builder
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-34206MedJun 23, 2022
Jenkins Project
Jianliao Notification
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL.
CVE-2022-34204MedJun 23, 2022
Jenkins Project
Easyqa
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
CVE-2022-34197MedJun 23, 2022
Jenkins Project
Sauce Ondemand
risk 0.28cvss 5.4epss 0.01
Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34191MedJun 23, 2022
Jenkins Project
NS-ND Integration Performance Publisher Plugin
risk 0.28cvss 5.4epss 0.01
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34188MedJun 23, 2022
Jenkins Project
Hidden Parameter
risk 0.28cvss 5.4epss 0.01
Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34170MedJun 23, 2022
Jenkins Project
Jenkins
risk 0.28cvss 5.4epss 0.01
In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability…
CVE-2022-30957MedMay 17, 2022
Jenkins Project
SSH
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-30949MedMay 17, 2022
Jenkins Project
Repo
risk 0.28cvss 5.3epss 0.01
Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
CVE-2022-29049MedApr 12, 2022
Jenkins Project
Promoted Builds
risk 0.28cvss 5.4epss 0.01
Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.
CVE-2022-29047MedApr 12, 2022
Jenkins Project
Pipeline: Shared Groovy Libraries Plugin
risk 0.28cvss 5.3epss 0.01
Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the…
CVE-2022-29044MedApr 12, 2022
Jenkins Project
Node And Label Parameter
risk 0.28cvss 5.4epss 0.01
Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-29043MedApr 12, 2022
Jenkins Project
Mask Passwords
risk 0.28cvss 5.4epss 0.01
Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-29041MedApr 12, 2022
Jenkins Project
Jira
risk 0.28cvss 5.4epss 0.01
Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with…
CVE-2022-29039MedApr 12, 2022
Jenkins Project
Gerrit Trigger
risk 0.28cvss 5.4epss 0.01
Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-29037MedApr 12, 2022
Jenkins Project
Cvs
risk 0.28cvss 5.4epss 0.01
Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-28152MedMar 29, 2022
Jenkins Project
Job And Node Ownership
risk 0.28cvss 4.3epss 0.01
A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore the default ownership of a job.
CVE-2022-28151MedMar 29, 2022
Jenkins Project
Job And Node Ownership
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change the owners and item-specific permissions of a job.
CVE-2022-28145MedMar 29, 2022
Jenkins Project
Continuous Integration With Toad Edge
risk 0.28cvss 5.4epss 0.01
Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a stored cross-site scripting (XSS) exploitable by attackers with Item/Configure permission or otherwise able to control…
CVE-2022-28138MedMar 29, 2022
Jenkins Project
Rocketchat Notifier
risk 0.28cvss 4.3epss 0.01
A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credential.
CVE-2022-27218MedMar 15, 2022
Jenkins Project
Incapptic Connect Uploader
risk 0.28cvss 4.3epss 0.01
Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVE-2022-27215MedMar 15, 2022
Jenkins Project
Release Helper
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2022-27214MedMar 15, 2022
Jenkins Project
Release Helper
risk 0.28cvss 4.3epss 0.00
A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2022-27205MedMar 15, 2022
Jenkins Project
Extended Choice Parameter
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-27199MedMar 15, 2022
Jenkins Project
Cloudbees AWS Credentials
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.
CVE-2022-27197MedMar 15, 2022
Jenkins Project
Dashboard View
risk 0.28cvss 5.4epss 0.01
Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.
CVE-2022-27196MedMar 15, 2022
Jenkins Project
Favorite
risk 0.28cvss 5.4epss 0.01
Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.
CVE-2022-25191MedFeb 15, 2022
Jenkins Project
Agent Server Parameter
risk 0.28cvss 5.4epss 0.01
Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-25189MedFeb 15, 2022
Jenkins Project
Custom Checkbox Parameter
risk 0.28cvss 5.4epss 0.01
Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-25185MedFeb 15, 2022
Jenkins Project
Generic Webhook Trigger
risk 0.28cvss 5.4epss 0.01
Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Page 28 of 39