Vulnerabilities > Jenkins > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-10-05 | CVE-2017-1000089 | Incorrect Default Permissions vulnerability in Jenkins Pipeline: Build Step Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. | 5.3 |
| 2017-10-05 | CVE-2017-1000088 | Cross-site Scripting vulnerability in Jenkins Sidebar Link The Sidebar Link plugin allows users able to configure jobs, views, and agents to add entries to the sidebar of these objects. | 5.4 |
| 2017-10-05 | CVE-2017-1000087 | Information Exposure vulnerability in Jenkins Github Branch Source GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. | 4.3 |
| 2017-10-05 | CVE-2017-1000085 | Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Subversion Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. | 6.5 |
| 2017-10-05 | CVE-2017-1000084 | Incorrect Default Permissions vulnerability in Jenkins Parameterized Trigger Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins. | 6.5 |
| 2017-09-12 | CVE-2014-9635 | 7PK - Security Features vulnerability in Jenkins Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies. | 5.3 |
| 2017-09-12 | CVE-2014-9634 | 7PK - Security Features vulnerability in Jenkins Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session. | 5.3 |
| 2017-02-09 | CVE-2016-4988 | Cross-site Scripting vulnerability in Jenkins Build Failure Analyzer Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. | 6.1 |
| 2017-02-09 | CVE-2016-4987 | Path Traversal vulnerability in Jenkins Image Gallery Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories and read arbitrary files via unspecified form fields. | 6.5 |
| 2017-02-09 | CVE-2016-3101 | Cross-site Scripting vulnerability in Jenkins Extra Columns Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web script or HTML by leveraging failure to filter tool tips through the configured markup formatter. | 5.4 |