WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor org.jenkins-ci.main✕
Overview 266 matches · 259 in Waratek scope · 31 protected · 8 exploited · 4 CISA KEV · 16 public PoC · 11 EPSS ≥ 0.5
266matches 259in Waratek scope97.4% 31protected11.7% 8exploited3.0% 4CISA KEV1.5% 16public PoC6.0% 11EPSS ≥ 0.54.1%
Protected by Waratek 31 11.7% Rule in development 0 0.0% Mitigation candidate 11 4.1% No exploit published 217 81.6% Outside Waratek scope 4 1.5% Not applicable 3 1.1% Withdrawn CVE 0 0.0%
Critical 19 7.1% High 62 23.3% Medium 175 65.8% Low 10 3.8% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 31 11.7% partly blocked 0 0.0% not blocked 235 88.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 8 3.0% Working exploit published 9 3.4% Proof of concept only 1 0.4% Forecast only 1 0.4% No public exploit 247 92.9%
split by peak 58 / year
Not applicable: 3Outside Waratek scope: 4No exploit published: 217Mitigation candidate: 11Protected by Waratek: 31 Low: 10Medium: 175High: 62Critical: 19 not blocked: 235blocked by ARMR today: 31 No public exploit: 247Forecast only: 1Proof of concept only: 1Working exploit published: 9Exploited: 8
20111 No exploit published1 Low1 not blocked1 No public exploit1 20122 No exploit published2 Medium2 not blocked2 No public exploit2 201310 Mitigation candidate2 No exploit published8 High1 Medium7 Low2 not blocked10 Exploited1 Working exploit published1 No public exploit8 201422 Protected by Waratek2 No exploit published20 High2 Medium17 Low3 blocked by ARMR today2 not blocked20 No public exploit22 201518 Protected by Waratek3 No exploit published14 Outside Waratek scope1 Critical1 High3 Medium13 Low1 blocked by ARMR today3 not blocked15 Exploited1 Working exploit published1 No public exploit16 201616 Protected by Waratek1 Mitigation candidate1 No exploit published14 Critical2 High5 Medium9 blocked by ARMR today1 not blocked15 Working exploit published1 No public exploit15 20175 Mitigation candidate1 No exploit published4 Critical2 Medium3 not blocked5 Exploited1 No public exploit4 201858 Protected by Waratek6 Mitigation candidate1 No exploit published47 Outside Waratek scope2 Not applicable2 Critical2 High13 Medium41 Low2 blocked by ARMR today6 not blocked52 Exploited2 Working exploit published1 No public exploit55 201924 Protected by Waratek3 Mitigation candidate1 No exploit published19 Outside Waratek scope1 High7 Medium17 blocked by ARMR today3 not blocked21 Working exploit published1 No public exploit23 202021 Protected by Waratek2 Mitigation candidate4 No exploit published15 High5 Medium16 blocked by ARMR today2 not blocked19 Working exploit published4 No public exploit17 202130 Protected by Waratek6 No exploit published23 Not applicable1 Critical10 High6 Medium14 blocked by ARMR today6 not blocked24 No public exploit30 202213 Protected by Waratek4 No exploit published9 High5 Medium8 blocked by ARMR today4 not blocked9 No public exploit13 202314 No exploit published14 Critical1 High7 Medium6 not blocked14 No public exploit14 20246 Protected by Waratek2 No exploit published4 Critical1 High2 Medium3 blocked by ARMR today2 not blocked4 Exploited1 Proof of concept only1 Forecast only1 No public exploit3 202514 Mitigation candidate1 No exploit published13 High1 Medium12 Low1 not blocked14 Exploited1 No public exploit13 202612 Protected by Waratek2 No exploit published10 High5 Medium7 blocked by ARMR today2 not blocked10 Exploited1 No public exploit11
20122014201620182020202220242026
266 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 3 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-53442 Medium 2026-06-10 No exploit published No public exploit Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
CVE-2026-53441 Medium 2026-06-10 No exploit published No public exploit Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
CVE-2026-53440 Medium 2026-06-10 No exploit published No public exploit Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain.
CVE-2026-53439 Medium 2026-06-10 No exploit published No public exploit Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users' configured timezone and to enumerate view names of other users' "My Views".
CVE-2026-53438 Medium 2026-06-10 No exploit published No public exploit A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission, to cancel queue items they do not have permission to view.
CVE-2026-53437 High 2026-06-10 No exploit published No public exploit Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.
CVE-2026-53436 Medium 2026-06-10 No exploit published No public exploit Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path segments (`./` or `../`), allowing attackers to perform phishing attacks.
CVE-2026-53435 High 2026-06-10 Protected by Waratek Exploited In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.
CVE-2026-33002 High 2026-03-18 No exploit published No public exploit Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.
CVE-2026-33001 High 2026-03-18 Protected by Waratek No public exploit Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
CVE-2026-27100 Medium 2026-02-18 No exploit published No public exploit Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.
CVE-2026-27099 High 2026-02-18 No exploit published No public exploit Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.
CVE-2025-67639 Low 2025-12-10 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.
CVE-2025-67638 Medium 2025-12-10 No exploit published No public exploit Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2025-67637 Medium 2025-12-10 No exploit published No public exploit Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVE-2025-67636 Medium 2025-12-10 No exploit published No public exploit A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.
CVE-2025-67635 High 2025-12-10 No exploit published No public exploit Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
CVE-2025-59476 Medium 2025-09-17 No exploit published No public exploit Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.
CVE-2025-59475 Medium 2025-09-17 No exploit published No public exploit Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).
CVE-2025-59474 Medium 2025-09-17 Mitigation candidate Exploited Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.
CVE-2025-31721 Medium 2025-04-02 No exploit published No public exploit A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.
CVE-2025-31720 Medium 2025-04-02 No exploit published No public exploit A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration.
CVE-2025-27625 Medium 2025-03-05 No exploit published No public exploit In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as part of scheme-relative redirects.
CVE-2025-27624 Medium 2025-03-05 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets).
CVE-2025-27623 Medium 2025-03-05 No exploit published No public exploit Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets.
CVE-2025-27622 Medium 2025-03-05 No exploit published No public exploit Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets.
CVE-2024-47804 Medium 2024-10-02 No exploit published No public exploit If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to persist it, effectively bypassing the item creation restriction.
CVE-2024-47803 Medium 2024-10-02 No exploit published No public exploit Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form field.
CVE-2024-43045 Medium 2024-08-07 No exploit published No public exploit Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".
CVE-2024-43044 High 2024-08-07 Protected by Waratek Proof of concept only Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.
CVE-2024-23898 High 2024-01-24 No exploit published Forecast only Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
CVE-2024-23897 Critical 2024-01-24 Protected by Waratek Exploited Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
CVE-2023-43498 High 2023-09-20 No exploit published No public exploit In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.
CVE-2023-43497 High 2023-09-20 No exploit published No public exploit In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.
CVE-2023-43496 High 2023-09-20 No exploit published No public exploit Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system temporary directory to replace the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.
CVE-2023-43495 Medium 2023-09-20 No exploit published No public exploit Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.
CVE-2023-43494 Medium 2023-09-20 No exploit published No public exploit Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.
CVE-2023-39151 Medium 2023-07-26 No exploit published No public exploit Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.
CVE-2023-35141 High 2023-06-14 No exploit published No public exploit In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.
CVE-2023-27904 Medium 2023-03-10 No exploit published No public exploit Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.
CVE-2023-27903 Medium 2023-03-10 No exploit published No public exploit Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used.
CVE-2023-27902 Medium 2023-03-10 No exploit published No public exploit Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their contents.
CVE-2023-27901 High 2023-03-10 No exploit published No public exploit Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service.
CVE-2023-27900 High 2023-03-10 No exploit published No public exploit Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.
CVE-2023-27899 High 2023-03-10 No exploit published No public exploit Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a plugin for installation, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used, potentially resulting in arbitrary code execution.
CVE-2023-27898 Critical 2023-03-10 No exploit published No public exploit Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
CVE-2022-45401 Medium 2022-11-15 No exploit published No public exploit Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-45388 High 2022-11-15 No exploit published No public exploit Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system.
CVE-2022-45384 Medium 2022-11-15 No exploit published No public exploit Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
CVE-2022-38666 High 2022-11-15 No exploit published No public exploit Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several features.
CVE-2022-41224 Medium 2022-09-21 No exploit published No public exploit Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.
CVE-2022-34175 High 2022-06-23 No exploit published No public exploit Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view.
CVE-2022-34174 High 2022-06-23 No exploit published No public exploit In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.
CVE-2022-34173 Medium 2022-06-23 Protected by Waratek No public exploit In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVE-2022-34172 Medium 2022-06-23 Protected by Waratek No public exploit In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.
CVE-2022-34171 Medium 2022-06-23 Protected by Waratek No public exploit In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.
CVE-2022-34170 Medium 2022-06-23 Protected by Waratek No public exploit In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVE-2022-0538 High 2022-02-09 No exploit published No public exploit Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.
CVE-2022-20612 Medium 2022-01-12 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
CVE-2021-21697 Critical 2021-11-04 No exploit published No public exploit Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.
CVE-2021-21696 Critical 2021-11-04 No exploit published No public exploit Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library with a modified variant. This results in unsandboxed code execution in the Jenkins controller process.
CVE-2021-21695 High 2021-11-04 No exploit published No public exploit FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
CVE-2021-21694 Critical 2021-11-04 No exploit published No public exploit FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
CVE-2021-21693 Critical 2021-11-04 No exploit published No public exploit When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
CVE-2021-21692 Critical 2021-11-04 Protected by Waratek No public exploit FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission on the source path, instead of 'delete'.
CVE-2021-21691 Critical 2021-11-04 No exploit published No public exploit Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
CVE-2021-21690 Critical 2021-11-04 Protected by Waratek No public exploit Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
CVE-2021-21689 Critical 2021-11-04 No exploit published No public exploit FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
CVE-2021-21688 High 2021-11-04 No exploit published No public exploit The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, FilePath#copyRecursiveTo).
CVE-2021-21687 Critical 2021-11-04 No exploit published No public exploit Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.
CVE-2021-21686 High 2021-11-04 Protected by Waratek No public exploit File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.
CVE-2021-21685 Critical 2021-11-04 No exploit published No public exploit Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs.
CVE-2021-21683 Medium 2021-10-06 Protected by Waratek No public exploit The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files.
CVE-2021-21682 Medium 2021-10-06 No exploit published No public exploit Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows.
CVE-2021-21671 High 2021-06-30 No exploit published No public exploit Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.
CVE-2021-21670 Medium 2021-06-30 No exploit published No public exploit Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.
CVE-2021-21640 Medium 2021-04-07 No exploit published No public exploit Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.
CVE-2021-21639 Medium 2021-04-07 No exploit published No public exploit Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one of a different type.
CVE-2021-21615 Medium 2021-01-26 No exploit published No public exploit Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.
CVE-2021-21611 Medium 2021-01-13 No exploit published No public exploit Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.
CVE-2021-21610 Medium 2021-01-13 Not applicable No public exploit Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.
CVE-2021-21609 Medium 2021-01-13 No exploit published No public exploit Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission.
CVE-2021-21608 Medium 2021-01-13 No exploit published No public exploit Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels.
CVE-2021-21607 Medium 2021-01-13 No exploit published No public exploit Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors.
CVE-2021-21606 Medium 2021-01-13 No exploit published No public exploit Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path.
CVE-2021-21605 High 2021-01-13 Protected by Waratek No public exploit Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global `config.xml` file.
CVE-2021-21604 High 2021-01-13 Protected by Waratek No public exploit Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator.
CVE-2021-21603 Medium 2021-01-13 No exploit published No public exploit Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability.
CVE-2021-21602 Medium 2021-01-13 No exploit published No public exploit Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.
CVE-2020-2231 Medium 2020-08-12 Mitigation candidate Working exploit published Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.
CVE-2020-2230 Medium 2020-08-12 Mitigation candidate Working exploit published Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.
CVE-2020-2229 Medium 2020-08-12 Mitigation candidate Working exploit published Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
CVE-2020-2223 Medium 2020-07-15 No exploit published No public exploit Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2222 Medium 2020-07-15 No exploit published No public exploit Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2221 Medium 2020-07-15 No exploit published No public exploit Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2220 Medium 2020-07-15 No exploit published No public exploit Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2163 Medium 2020-03-25 No exploit published No public exploit Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability exploitable by users able to control column headers.
CVE-2020-2162 Medium 2020-03-25 No exploit published No public exploit Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.
CVE-2020-2161 Medium 2020-03-25 No exploit published No public exploit Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.
CVE-2020-2160 High 2020-03-25 No exploit published No public exploit Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
‹ prev page 1 of 3 next ›