Vulnerabilities > Jenkins > Medium

DATE CVE VULNERABILITY TITLE RISK
2018-06-05 CVE-2018-1000194 Path Traversal vulnerability in multiple products
A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection.
network
low complexity
jenkins oracle CWE-22
5.5
2018-06-05 CVE-2018-1000193 Injection vulnerability in multiple products
A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and cannot be deleted via the UI.
network
low complexity
jenkins oracle CWE-74
4.0
2018-06-05 CVE-2018-1000192 A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read access to enumerate all installed plugins.
network
low complexity
jenkins oracle
4.0
2018-06-05 CVE-2018-1000191 Information Exposure vulnerability in Jenkins Synopsys Detect
A exposure of sensitive information vulnerability exists in Jenkins Black Duck Detect Plugin 1.4.0 and older in DetectPostBuildStepDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
network
low complexity
jenkins CWE-200
4.0
2018-06-05 CVE-2018-1000190 Information Exposure vulnerability in Jenkins Black Duck HUB
A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
network
low complexity
jenkins CWE-200
4.0
2018-06-05 CVE-2018-1000189 Unspecified vulnerability in Jenkins Absint Astree
A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with Overall/Read access to execute a command on the Jenkins master.
network
low complexity
jenkins
6.5
2018-06-05 CVE-2018-1000188 Server-Side Request Forgery (SSRF) vulnerability in Jenkins CAS
A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.
network
low complexity
jenkins CWE-918
5.5
2018-06-05 CVE-2018-1000187 Information Exposure vulnerability in Jenkins Kubernetes
A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that results in sensitive variables such as passwords being written to logs.
network
low complexity
jenkins CWE-200
4.0
2018-06-05 CVE-2018-1000186 Information Exposure vulnerability in Jenkins Github Pull Request Builder
A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
network
low complexity
jenkins CWE-200
4.0
2018-06-05 CVE-2018-1000185 Server-Side Request Forgery (SSRF) vulnerability in Jenkins Github Branch Source
A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.
network
low complexity
jenkins CWE-918
4.0