Vulnerabilities > Jenkins > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-06-30 | CVE-2021-21675 | Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Requests A cross-site request forgery (CSRF) vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests and/or have administrators apply pending requests. | 6.5 |
| 2021-06-30 | CVE-2021-21676 | Missing Authorization vulnerability in Jenkins Requests Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to send test emails to an attacker-specified email address. | 4.3 |
| 2021-06-16 | CVE-2021-21667 | Cross-site Scripting vulnerability in Jenkins Scriptler 3.1/3.2 Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission. | 5.4 |
| 2021-06-16 | CVE-2021-21668 | Cross-site Scripting vulnerability in Jenkins Scriptler 3.1 Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission. | 5.4 |
| 2021-06-10 | CVE-2021-21661 | Unspecified vulnerability in Jenkins Kubernetes Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | 4.3 |
| 2021-06-10 | CVE-2021-21662 | Unspecified vulnerability in Jenkins Xebialabs XL Deploy A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins. | 4.3 |
| 2021-06-10 | CVE-2021-21663 | Unspecified vulnerability in Jenkins Xebialabs XL Deploy A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins. | 4.3 |
| 2021-06-10 | CVE-2021-21664 | Incorrect Authorization vulnerability in Jenkins Xebialabs XL Deploy An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins. | 6.5 |
| 2021-06-10 | CVE-2021-21666 | Cross-site Scripting vulnerability in Jenkins Kiuwan Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability. | 6.1 |
| 2021-05-25 | CVE-2021-21660 | Cross-site Scripting vulnerability in Jenkins Markdown Formatter 0.1.0 Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter. | 5.4 |