Vulnerabilities > Jenkins > Medium

DATE CVE VULNERABILITY TITLE RISK
2018-06-26 CVE-2018-1000609 Information Exposure vulnerability in Jenkins Configuration AS Code
A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration.
network
low complexity
jenkins CWE-200
6.5
2018-06-26 CVE-2018-1000607 Improper Input Validation vulnerability in Jenkins Fortify Cloudscan
A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the permissions of the user the Jenkins master process is running as.
network
low complexity
jenkins CWE-20
6.5
2018-06-26 CVE-2018-1000606 Server-Side Request Forgery (SSRF) vulnerability in Jenkins Urltrigger
A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.
network
low complexity
jenkins CWE-918
6.5
2018-06-26 CVE-2018-1000604 Cross-site Scripting vulnerability in Jenkins Badge
A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
network
low complexity
jenkins CWE-79
5.4
2018-06-26 CVE-2018-1000602 Session Fixation vulnerability in Jenkins Saml
A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the pre-authentication session.
network
high complexity
jenkins CWE-384
5.9
2018-06-26 CVE-2018-1000601 Information Exposure vulnerability in Jenkins SSH Credentials
A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.
network
low complexity
jenkins CWE-200
6.5
2018-06-05 CVE-2018-1000202 Cross-site Scripting vulnerability in Jenkins Groovy Postbuild
A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
network
low complexity
jenkins CWE-79
5.4
2018-06-05 CVE-2018-1000198 XXE vulnerability in Jenkins Black Duck HUB
A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read permission to make Jenkins process XML eternal entities in an XML document.
network
low complexity
jenkins CWE-611
6.5
2018-06-05 CVE-2018-1000196 Information Exposure vulnerability in Jenkins Gitlab Hook
A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_notifier/global.erb that allows attackers with local Jenkins master file system access or control of a Jenkins administrator's web browser (e.g.
network
low complexity
jenkins CWE-200
6.5
2018-06-05 CVE-2018-1000195 Cross-Site Request Forgery (CSRF) vulnerability in multiple products
A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful (200) or not.
network
low complexity
jenkins oracle CWE-352
4.3