Vulnerabilities > Jenkins > Jenkins > 1.554.1

DATE CVE VULNERABILITY TITLE RISK
2019-09-25 CVE-2019-10405 Cross-site Scripting vulnerability in Jenkins
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
network
low complexity
jenkins CWE-79
5.4
2019-09-25 CVE-2019-10404 Cross-site Scripting vulnerability in Jenkins
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored XSS vulnerability exploitable by users able to control parts of the reason a queue item is blocked, such as label expressions not matching any idle executors.
network
low complexity
jenkins CWE-79
5.4
2019-09-25 CVE-2019-10403 Cross-site Scripting vulnerability in Jenkins
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
network
low complexity
jenkins CWE-79
5.4
2019-09-25 CVE-2019-10402 Cross-site Scripting vulnerability in Jenkins
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents.
network
low complexity
jenkins CWE-79
5.4
2019-09-25 CVE-2019-10401 Cross-site Scripting vulnerability in Jenkins
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents (typically Job/Configure).
network
low complexity
jenkins CWE-79
5.4
2019-08-28 CVE-2019-10384 Cross-Site Request Forgery (CSRF) vulnerability in multiple products
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
network
low complexity
jenkins oracle redhat CWE-352
8.8
2019-08-28 CVE-2019-10383 Cross-site Scripting vulnerability in multiple products
A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.
network
low complexity
jenkins oracle redhat CWE-79
4.8
2019-07-17 CVE-2019-10354 Missing Authorization vulnerability in multiple products
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
network
low complexity
jenkins redhat CWE-862
4.3
2019-07-17 CVE-2019-10353 Cross-Site Request Forgery (CSRF) vulnerability in Jenkins
CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.
network
high complexity
jenkins CWE-352
7.5
2019-07-17 CVE-2019-10352 Path Traversal vulnerability in Jenkins
A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.
network
low complexity
jenkins CWE-22
6.5