Vulnerabilities > Jenkins

DATE CVE VULNERABILITY TITLE RISK
2018-07-09 CVE-2018-1000402 Information Exposure vulnerability in Jenkins AWS Codedeploy
Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a File and Directory Information Exposure vulnerability in AWSCodeDeployPublisher.java that can result in Disclosure of environment variables.
network
low complexity
jenkins CWE-200
5.0
2018-07-09 CVE-2018-1000401 Insufficiently Protected Credentials vulnerability in Jenkins AWS Codepipeline
Jenkins project Jenkins AWS CodePipeline Plugin version 0.36 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodePipelineSCM.java that can result in Credentials Disclosure.
local
low complexity
jenkins CWE-522
2.1
2018-06-26 CVE-2018-1000610 Insufficiently Protected Credentials vulnerability in Jenkins Configuration AS Code
A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords configured using Configuration as Code Plugin.
network
low complexity
jenkins CWE-522
4.0
2018-06-26 CVE-2018-1000609 Information Exposure vulnerability in Jenkins Configuration AS Code
A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration.
network
low complexity
jenkins CWE-200
4.0
2018-06-26 CVE-2018-1000608 Insufficiently Protected Credentials vulnerability in Jenkins Z/Os Connector
A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g.
network
low complexity
jenkins CWE-522
4.0
2018-06-26 CVE-2018-1000607 Improper Input Validation vulnerability in Jenkins Fortify Cloudscan
A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the permissions of the user the Jenkins master process is running as.
network
low complexity
jenkins CWE-20
4.0
2018-06-26 CVE-2018-1000606 Server-Side Request Forgery (SSRF) vulnerability in Jenkins Urltrigger
A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.
network
low complexity
jenkins CWE-918
4.0
2018-06-26 CVE-2018-1000605 Improper Certificate Validation vulnerability in Jenkins Collabnet
A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java that allows attackers to impersonate any service that Jenkins connects to.
network
jenkins CWE-295
5.8
2018-06-26 CVE-2018-1000604 Cross-site Scripting vulnerability in Jenkins Badge
A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
network
jenkins CWE-79
3.5
2018-06-26 CVE-2018-1000603 Information Exposure vulnerability in Jenkins Openstack Cloud
A exposure of sensitive information vulnerability exists in Jenkins Openstack Cloud Plugin 2.35 and earlier in BootSource.java, InstancesToRun.java, JCloudsCleanupThread.java, JCloudsCloud.java, JCloudsComputer.java, JCloudsPreCreationThread.java, JCloudsRetentionStrategy.java, JCloudsSlave.java, JCloudsSlaveTemplate.java, LauncherFactory.java, OpenstackCredentials.java, OpenStackMachineStep.java, SlaveOptions.java, SlaveOptionsDescriptor.java that allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins, and to cause Jenkins to submit HTTP requests to attacker-specified URLs.
network
low complexity
jenkins CWE-200
4.0