org.jenkins-ci.main:jenkins-core
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Maven
- Vulnerability status
- affected by 241 advisory(ies)
Advisories (259)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-223m-4rfp-646h Jenkins is missing a permission check in the authenticated users' profile menu | < 2.516.3 ; 2.517 – < 2.528 | Affected |
| GHSA-25c5-58xw-hw5q Jenkins allows Remote Users to Build Arbitrary Jobs | 1.481 – < 1.502 ; < 1.480.3 | Affected |
| GHSA-2632-h32j-6rg9 Missing Release of Resource after Effective Lifetime in Jenkins | < 2.121.3 ; 2.122 – < 2.138 | Affected |
| GHSA-26wc-3wqp-g3rp Deserialization of Untrusted Data in Jenkins | 2.50 – < 2.57 ; < 2.46.2 | Affected |
| GHSA-279f-qwgh-h5mp Jenkins does not exclude sensitive build variables from search | 2.50 – < 2.414.2 ; 2.415 – < 2.424 | Not affected |
| GHSA-28p3-mchr-9frj Deserialization of Untrusted Data in Jenkins | < 2.121.3 ; 2.122 – < 2.138 | Affected |
| GHSA-2c79-h2h5-g3fw Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins | < 2.303.3 ; 2.304 – < 2.319 | Affected |
| GHSA-2pp9-r4rv-6p6j Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.121.2 ; 2.122 – < 2.132 | Affected |
| GHSA-2q8v-qx2x-hxjx Jenkins allows HTTP Injection and Response Splitting | 1.481 – < 1.491 ; < 1.480.1 | Affected |
| GHSA-2w4x-rxp7-grg7 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.107.3 ; 2.108 – < 2.121 | Affected |
| GHSA-2x9h-h3c4-wqqh Improper Neutralization of Special Elements used in an LDAP Query in Jenkins | 2.20 – < 2.32 ; < 2.19.3 | Affected |
| GHSA-2xcm-h7vv-g8m9 Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.228 ; 2.204.6 – < 2.228 | Affected |
| GHSA-3269-jqp5-v8c9 Jenkins allows for Privilege Escalation by Remote Authenticated Users | 1.597 – < 1.606 ; < 1.596.2 | Affected |
| GHSA-3297-944x-j7x7 Incorrect Authorization in Jenkins Core | < 2.44 | Affected |
| GHSA-34wx-x2w9-vqm3 DoS vulnerability in bundled XStream library in Jenkins Core | 2.320 – < 2.334 ; < 2.319.3 | Affected |
| GHSA-37wm-28rm-56vw Jenkins does not Restrict Reserved Names Allowing for Privilege Escalation | 1.597 – < 1.600 ; < 1.596.1 | Affected |
| GHSA-3857-xm38-jmq2 Incorrect Authorization in Jenkins Core | < 2.3 | Affected |
| GHSA-3gp5-92h5-h855 Jenkins Path Traversal vulnerability | 1.566 – < 1.583 ; < 1.565.3 | Affected |
| GHSA-3j9c-cp7m-8w8g Jenkins has XML External Entity (XXE) Vulnerability in Job Configuration via CLI | 1.626 – < 1.638 ; < 1.625.2 | Affected |
| GHSA-3pr8-rf62-g893 Path Traversal in Jenkins | < 2.138.2 ; 2.140 – < 2.146 | Affected |
| GHSA-3q84-vrvx-rfvf Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins | < 2.303.3 ; 2.304 – < 2.319 | Affected |
| GHSA-3rqh-hch3-jhpc Jenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL | 2.556 – < 2.568 ; < 2.555.3 | Affected |
| GHSA-3rwx-3vwh-mwxc Jenkins Vulnerable to Denial of Service (DoS) | 1.597 – < 1.600 ; < 1.596.1 | Affected |
| GHSA-3vhr-f5xr-8vpx Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack | 1.626 – < 1.640 ; < 1.625.2 | Affected |
| GHSA-3wmv-7php-rhg5 Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack | < 1.625.2 ; 1.626 – < 1.638 | Affected |
| GHSA-42m6-7xff-9v9m Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.32.2 ; 2.34 – < 2.44 | Affected |
| GHSA-4466-8jm4-448p Deserialization of Untrusted Data in Jenkins | 2.50 – < 2.57 ; < 2.46.2 | Affected |
| GHSA-449q-v4j2-5h8p Jenkins allows Exposure of Sensitive Information to an Unauthorized Actor | 1.626 – < 1.638 ; < 1.625.2 | Affected |
| GHSA-45rg-g72w-r393 Jenkins allows Deserialization of Untrusted Data via an XML File | 1.643 – < 1.650 ; < 1.642.2 | Affected |
| GHSA-4625-q52w-39cx Missing permission check for paths with specific prefix in Jenkins | < 2.263.2 ; 2.264 – < 2.275 | Affected |
| GHSA-463r-5m89-4xfr Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL | < 2.555.3 ; 2.556 – < 2.568 | Affected |
| GHSA-4653-rmch-3g2g Jenkins has Information Disclosure via Sidepanel Widget | 1.626 – < 1.638 ; < 1.625.2 | Affected |
| GHSA-47wc-p5cp-w7pw Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.176.4 ; 2.177 – < 2.197 | Affected |
| GHSA-4g38-hrm4-rg94 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins | < 2.303.3 ; 2.304 – < 2.319 | Affected |
| GHSA-4h47-h3cr-23wh Improper Authorization in Jenkins | < 2.138.2 ; 2.140 – < 2.146 | Affected |
| GHSA-4jhm-5f7g-75fp Improper Limitation of a Pathname to a Restricted Directory in Jenkins | < 2.138.4 ; 2.140 – < 2.154 | Affected |
| GHSA-4jjj-cm7q-v6hr Jenkins Diagnostic page exposed session cookies | 2.205 – < 2.219 ; < 2.204.2 | Affected |
| GHSA-4pw5-r58h-fv24 Path traversal vulnerability on Windows in Jenkins | < 2.303.2 ; 2.304 – < 2.315 | Affected |
| GHSA-4w4h-8qh9-342x Jenkins allows Cross-Site Scripting (XSS) | 1.425 – < 1.454 ; < 1.424.5 | Affected |
| GHSA-4wr9-2xc6-jmg5 Session fixation vulnerability in Jenkins | 2.292 – < 2.300 ; < 2.289.2 | Affected |
| GHSA-52g6-pfrq-rxfv Jenkins allows Cross-Site Scripting (XSS) in User Configuration | ≤ 1.523 | Affected |
| GHSA-53jp-gmwc-jwf6 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.138.2 ; 2.140 – < 2.146 | Affected |
| GHSA-53ph-2r2x-vqw8 Cross-site WebSocket hijacking vulnerability in the Jenkins CLI | 2.217 – < 2.426.3 ; 2.427 – < 2.442 ; 2.441 | Not affected |
| GHSA-55wp-3pq4-w8p9 Jenkins temporary plugin file created with insecure permissions | 2.50 – < 2.414.2 ; 2.415 – < 2.424 | Not affected |
| GHSA-565r-pf5q-45v6 Jenkins Missing Permission Check | 2.500 – < 2.504 ; < 2.492.3 | Affected |
| GHSA-584m-7r4m-8j6v Incorrect Authorization in Jenkins Core | 2.376 – < 2.387.1 ; < 2.375.4 ; 2.388 – < 2.394 | Affected |
| GHSA-58xm-mxjf-254g Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins | < 2.303.3 ; 2.304 – < 2.319 | Affected |
| GHSA-59fm-6x3q-q3q5 Missing permissions check in Jenkins Core | < 2.3 | Affected |
| GHSA-5c56-g5cq-4gj9 Jenkins Vulnerable to Denial of Service (DoS) via Crafted Payload | 1.481 – < 1.502 ; < 1.480.3 | Affected |
| GHSA-5hfp-964w-5vgm Improper Limitation of a Pathname to a Restricted Directory in Jenkins | < 2.138.2 ; 2.140 – < 2.146 | Affected |
| GHSA-5j46-5hwq-gwh7 Jenkins Cross-site Scripting vulnerability | 2.50 – < 2.414.2 ; 2.415 – < 2.424 | Not affected |
| GHSA-5mwr-jg3r-jv66 Jenkins allows Cross-Site Scripting (XSS) | < 1.625.2 ; 1.626 – < 1.638 | Affected |
| GHSA-5p59-v5wm-77v4 Improper Limitation of a Pathname to a Restricted Directory in Jenkins | < 2.89.4 ; 2.90 – < 2.107 | Affected |
| GHSA-5ppx-rgw2-xg23 Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.73.3 ; 2.74 – < 2.89 | Affected |
| GHSA-5xm3-48v5-6h7v Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code | 1.566 – < 1.583 ; < 1.565.3 | Affected |
| GHSA-5xmf-9vgr-53mj Jenkins allows Unauthorized Viewing of Queue API Information | 1.626 – < 1.638 ; < 1.625.2 | Affected |
| GHSA-62wf-24c4-8r76 Cross-site Scripting vulnerability in Jenkins | 2.350 – < 2.356 ; 2.320 – < 2.332.4 ; 2.346 – < 2.346.1 | Not affected |
| GHSA-6456-xjm5-g3pg Cross-site scripting vulnerability exists in Jenkins and Stapler Plugin | < 2.121.2 ; 2.122 – < 2.132 | Affected |
| GHSA-64mc-2m9p-23c8 Jenkins allows remote authenticated users to bypass intended restrictions and create or destroy arbitrary jobs | 1.566 – < 1.583 ; < 1.565.3 | Affected |
| GHSA-667q-vj58-rj88 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.121.3 ; 2.122 – < 2.138 | Affected |
| GHSA-66cr-6whx-732p Jenkins improperly ensures trust separation | < 1.587 | Affected |
| GHSA-67v4-38h7-9jjp Jenkins has a missing permission check, allowing users to obtain agent names | < 2.516.3 ; 2.517 – < 2.528 | Affected |
| GHSA-6837-qgrc-x5p6 Jenkins has a CSRF vulnerability on the login form | 2.529 – < 2.541 ; < 2.528.3 | Affected |
| GHSA-6967-9vvv-4cmm Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.32.2 ; 2.34 – < 2.44 | Affected |
| GHSA-69vw-3pcm-84rw Jenkins Stored Cross-site Scripting vulnerability | 2.402 – < 2.414.1 ; < 2.401.3 ; 2.415 – < 2.416 | Affected |
| GHSA-6cr3-cm5h-8q96 Jenkins Exposes Sensitive Information via API URL | 1.652 – < 2.3 ; < 1.651.2 | Affected |
| GHSA-6f9g-cxwr-q5jr Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE | 1.606 – < 2.426.3 ; 2.427 – < 2.440.1 ; 2.441 – < 2.442 | Not affected |
| GHSA-6g4r-q7qg-6qx6 Cross-site Scripting vulnerability in Jenkins | 2.340 – < 2.356 | Not affected |
| GHSA-6jfc-mc97-c7wg Missing Authorization in Jenkins | < 2.176.2 ; 2.177 – < 2.186 | Affected |
| GHSA-6mv9-hcx5-7mhh Server-Side Request Forgery in Jenkins | < 2.89.4 ; 2.90 – < 2.107 | Affected |
| GHSA-6q4g-84f3-mw74 Improper handling of equivalent directory names on Windows in Jenkins | 2.304 – < 2.315 ; < 2.303.2 | Affected |
| GHSA-6rh5-23hx-j452 Improper Authorization in Jenkins Core | < 2.150.2 ; 2.151 – < 2.159 | Affected |
| GHSA-742j-jcfr-23w3 Insufficient Session Expiration in Jenkins | < 2.164.2 ; 2.165 – < 2.172 | Affected |
| GHSA-7592-93rm-6gpx Injection in Jenkins | < 2.107.3 ; 2.108 – < 2.121 | Affected |
| GHSA-78cj-2m29-q5r9 Jenkins Cross-Site Request Forgery vulnerability | 1.481 – < 1.502 ; < 1.480.3 | Affected |
| GHSA-7cjc-xppr-xj6x Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.176.4 ; 2.177 – < 2.197 | Affected |
| GHSA-7f6w-fhmr-j8hq Jenkins HttpOnly flag not Set for session cookies | < 1.586 | Affected |
| GHSA-7f84-p6r5-jr6q Cross-site Scripting vulnerability in Jenkins | 2.350 – < 2.356 ; 2.346 – < 2.346.1 ; < 2.332.4 | Affected |
| GHSA-7fpg-pp3m-h22f Jenkins allows attackers to execute arbitrary jobs | 1.533 – < 1.551 ; < 1.532.2 | Affected |
| GHSA-7g95-jmg9-h524 Jenkins cross-site request forgery (CSRF) vulnerability | 2.493 – < 2.500 ; < 2.492.2 | Affected |
| GHSA-7qf3-c2q8-69m3 Reflected XSS vulnerability in Jenkins markup formatter preview | < 2.263.2 ; 2.264 – < 2.275 | Affected |
| GHSA-7r4h-2h23-6jq9 Incorrect Authorization in Jenkins | < 2.32.2 ; 2.34 – < 2.44 | Affected |
| GHSA-7vvj-qqvj-h8mc Jenkins Exposes Sensitive Information from Job Configuration | 1.652 – < 2.3 ; < 1.651.2 | Affected |
| GHSA-7xp8-7wqx-5hqx Jenkins REST APIs vulnerable to clickjacking | < 2.204.2 ; 2.205 – < 2.219 | Affected |
| GHSA-826f-32qm-vm3j Jenkins vulnerable to Cross-site Scripting | < 1.509.1 ; 1.513 – < 1.514 | Affected |
| GHSA-8572-5jrg-mx52 Exposure of Sensitive Information in Jenkins Core | < 2.3 | Affected |
| GHSA-85h6-5m3v-gx37 Jenkins has a stored XSS vulnerability in node offline cause description | 2.542 – < 2.551 ; 2.483 – < 2.541.2 | Not affected |
| GHSA-85wq-pqhp-hmq6 Cross-Site Request Forgery in Jenkins | 2.50 – < 2.57 ; < 2.46.2 | Affected |
| GHSA-864v-5q2g-fr64 Stored XSS vulnerability in Jenkins 'keep forever' badge icon | < 2.235.2 ; 2.236 – < 2.245 | Affected |
| GHSA-89vc-7frq-2rfj Jenkins has Local File Inclusion Vulnerability | 1.626 – < 1.638 ; < 1.625.2 | Affected |
| GHSA-8hmv-92wm-39ch Jenkins Open Redirect vulnerability | < 2.492.2 ; 2.493 – < 2.500 | Affected |
| GHSA-8jfx-h6q2-v4g3 Jenkins session fixation vulnerability | 1.533 – < 1.551 ; < 1.532.2 | Affected |
| GHSA-8p3c-m625-wh83 Jenkins has CRLF Injection Vulnerability in the CLI | 1.643 – < 1.650 ; < 1.642.2 | Affected |
| GHSA-8pqx-3rxx-f5pm Jenkins discloses project names via fingerprints | < 1.625.2 ; 1.626 – < 1.638 | Affected |
| GHSA-8pv9-qh96-9hc6 Jenkins does not perform a permission check in an HTTP endpoint | < 2.452.4 ; 2.460 – < 2.462.1 ; 2.470 – < 2.471 | Affected |
| GHSA-8qpf-fv36-h4r8 Infinite Loop in Jenkins Core | < 2.138 | Affected |
| GHSA-8qxp-g8jv-p37x Improper Authorization in Jenkins Core | < 2.159 | Affected |
| GHSA-8x8p-mfwv-9fjw Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability | 1.566 – < 1.583 ; < 1.565.3 | Affected |
| GHSA-8xg4-xq2v-v6j7 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins | < 2.303.3 ; 2.304 – < 2.319 | Affected |
| GHSA-929w-q433-4h9x Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins | < 2.303.3 ; 2.304 – < 2.319 | Affected |
| GHSA-92m7-4fpw-2wxm Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container" | < 2.555.3 ; 2.556 – < 2.568 | Affected |
| GHSA-92mr-4w2q-4578 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | 1.498 – < 2.32.2 ; 2.40 – < 2.44 | Not affected |
| GHSA-93qh-vwrm-c5pw Jenkins: Stored XSS vulnerability in node offline cause description | 2.483 – < 2.568 | Not affected |
| GHSA-97c3-w9cr-6qc2 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins | < 2.303.3 ; 2.304 – < 2.319 | Affected |
| GHSA-98fp-r22g-wpj7 Jenkins CSRF protection bypass vulnerability | < 2.400 | Affected |
| GHSA-98gq-6hxg-52r6 XSS vulnerability in Jenkins notification bar | < 2.275 ; 2.263.2 – < 2.275 | Affected |
| GHSA-99hj-ppg3-2xwc Cross-Site Request Forgery in Jenkins | 2.81 – < 2.89.2 ; 2.90 – < 2.95 | Not affected |
| GHSA-9c26-cf8c-mw43 Jenkins allows Remote Attackers to Hijack Sessions | < 1.532.2 ; 1.533 – < 1.551 | Affected |
| GHSA-9cjv-93g7-c6mv Loop with Unreachable Exit Condition in Jenkins | < 2.138.4 ; 2.140 – < 2.154 | Affected |
| GHSA-9g4m-ffx6-c29g Jenkins Cross-site Scripting vulnerability in project naming strategy | < 2.235.4 ; 2.236 – < 2.252 | Affected |
| GHSA-9grj-j43m-mjqr Observable timing discrepancy allows determining username validity in Jenkins | 2.334 – < 2.356 ; < 2.332.4 | Affected |
| GHSA-9h85-v6xf-h26q Jenkins allows Cross-Site Scripting (XSS) | 1.597 – < 1.606 ; < 1.596.2 | Affected |
| GHSA-9hr6-5x6g-gg5g Jenkins allows Cross-Site Scripting (XSS) | 1.481 – < 1.491 ; < 1.480.1 | Affected |
| GHSA-9jcv-v4jp-w3cq Cross-site Scripting in Jenkins Core | 2.108 – < 2.116 ; < 2.107.2 | Affected |
| GHSA-9m48-54pj-h248 Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.176.3 ; 2.177 – < 2.192 | Affected |
| GHSA-9p56-p6mw-w8qc Jenkins has a Denial of service vulnerability in HTTP-based CLI | 2.529 – < 2.541 ; < 2.528.3 | Affected |
| GHSA-9qgf-4fpf-cmh2 Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.176.4 ; 2.177 – < 2.197 | Affected |
| GHSA-9vg9-x38g-9hfx Jenkins allows attackers to determine whether a user exists | 1.533 – < 1.551 ; < 1.532.2 | Affected |
| GHSA-c5r9-rx53-q3gf Agent-to-controller access control allowed writing to sensitive directory used by Jenkins Pipeline: Shared Groovy Libraries Plugin | < 2.303.3 ; 2.304 – < 2.319 | Affected |
| GHSA-c735-g9f2-2mvp Cross-Site Request Forgery in Jenkins | < 2.204.6 ; 2.205 – < 2.228 | Affected |
| GHSA-cc55-c9j4-m7cx Jenkins allows Cross-Site Scripting (XSS) | 1.425 – < 1.454 ; < 1.424.5 | Affected |
| GHSA-cj6r-8pxj-5jv6 Incorrect Permission Preservation in Jenkins Core | 2.376 – < 2.387.1 ; < 2.375.4 ; 2.388 – < 2.394 | Affected |
| GHSA-cpw3-x7gf-p872 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.107.2 ; 2.108 – < 2.116 | Affected |
| GHSA-crg2-6xv3-qg5f Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.228 ; 2.204.6 – < 2.228 | Affected |
| GHSA-cv2w-q8c3-xjv7 Agent-to-controller access control allows reading/writing most content of build directories in Jenkins | < 2.303.3 ; 2.304 – < 2.319 | Affected |
| GHSA-cvvm-4cr9-r436 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins | < 2.303.3 ; 2.304 – < 2.319 | Affected |
| GHSA-cwh9-f8m6-6r63 Jenkins Cross-site Scripting vulnerability | 1.566 – < 1.583 ; < 1.565.3 | Affected |
| GHSA-cxqw-vjcr-gp5g Excessive memory allocation in graph URLs leads to denial of service in Jenkins | < 2.263.2 ; 2.264 – < 2.275 | Affected |
| GHSA-f585-9fw3-rj2m Arbitrary file existence check in file fingerprints in Jenkins | < 2.263.2 ; 2.264 – < 2.275 | Affected |
| GHSA-f7f6-xrwc-9c57 Improper Input Validation in Jenkins | < 2.73.2 ; 2.74 – < 2.84 | Affected |
| GHSA-f9qj-77q2-h5c5 Jenkins item creation restriction bypass vulnerability | < 2.462.3 ; 2.466 – < 2.479 | Affected |
| GHSA-ffgg-vphh-v273 Incomplete List of Disallowed Inputs in Jenkins | < 2.32.2 ; 2.34 – < 2.44 | Affected |
| GHSA-fg4r-f9j2-36mw Jenkins Cross-Site Request Forgery vulnerabilities | < 1.509.1 ; 1.513 – < 1.514 | Affected |
| GHSA-fj6f-6933-839j Non-constant time HMAC comparison | < 2.204.2 ; 2.205 – < 2.219 | Affected |
| GHSA-fq9f-9wv9-rfmg Improper Certificate Validation in Jenkins | < 2.73.2 ; 2.74 – < 2.84 | Affected |
| GHSA-frgr-c5f2-8qhh Denial of service in Jenkins Core | 2.388 – < 2.394 ; < 2.375.4 ; 2.376 – < 2.387.1 | Affected |
| GHSA-fvfh-8mj3-23xj Jenkins allows for Code Execution via Crafted Packet to the CLI | 1.566 – < 1.583 ; < 1.565.3 | Affected |
| GHSA-fwqr-3pvp-pjwq Deserialization of Untrusted Data in Jenkins | < 2.32.2 ; 2.34 – < 2.44 | Affected |
| GHSA-fxj7-6v9w-xc76 Jenkins's build authorization token is stored and displayed in plain text | 2.529 – < 2.541 ; < 2.528.3 | Affected |
| GHSA-fxj8-cqcp-3vgq Jenkins cross-site scripting (XSS) vulnerability | 1.533 – < 1.551 ; < 1.532.2 | Affected |
| GHSA-fxqr-px2m-fvc2 Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability | 1.566 – < 1.583 ; < 1.565.3 | Affected |
| GHSA-g28p-6mcc-v4rv Jenkins exposes other users' timezone and view names to users with Overall/Read permission | < 2.555.3 ; 2.556 – < 2.568 | Affected |
| GHSA-g2xq-2v27-4rh3 Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation | < 2.555.3 ; 2.556 – < 2.568 | Affected |
| GHSA-g4j6-m3m3-crw8 Stored XSS vulnerability in Jenkins upstream cause | < 2.235.2 ; 2.236 – < 2.245 | Affected |
| GHSA-g78x-xmv8-23xp Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.73.2 ; 2.74 – < 2.84 | Affected |
| GHSA-g7cf-wg27-qw87 Jenkins secure flag not set on session cookies | < 1.586 | Affected |
| GHSA-g8pg-qrvm-wgh2 Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.228 ; 2.204.6 – < 2.228 | Affected |
| GHSA-gfhj-524q-gcrm Stored XSS vulnerability in Jenkins console links | < 2.235.2 ; 2.236 – < 2.245 | Affected |
| GHSA-gpxv-776p-7gc7 Jenkins vulnerable to UDP amplification reflection attack | < 2.204.2 ; 2.205 – < 2.219 | Affected |
| GHSA-h5jv-hg68-mjhg Jenkins allows attackers to configure restricted projects | 1.481 – < 1.502 ; < 1.480.3 | Affected |
| GHSA-h76p-mc68-jv3p Denial of service in Jenkins Core | 2.388 – < 2.394 ; < 2.375.4 ; 2.376 – < 2.387.1 | Affected |
| GHSA-h856-ffvv-xvr4 Jenkins Remoting library arbitrary file read vulnerability | < 2.452.4 ; 2.460 – < 2.462.1 ; 2.470 – < 2.471 | Affected |
| GHSA-h8c5-c92g-jq6x Improper Input Validation in Jenkins | < 2.73.2 ; 2.74 – < 2.84 | Affected |
| GHSA-h972-cwjv-2v39 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.73.2 ; 2.74 – < 2.84 | Affected |
| GHSA-hcxf-rq72-h4rr Cross-Site Request Forgery in Jenkins | < 2.176.2 ; 2.177 – < 2.186 | Affected |
| GHSA-hf9h-vv4m-2f33 Incorrect Authorization in Jenkins Core | 2.376 – < 2.387.1 ; < 2.375.4 ; 2.388 – < 2.394 | Affected |
| GHSA-hg6g-jj7g-x6v2 Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.176.4 ; 2.177 – < 2.197 | Affected |
| GHSA-hhpm-5cp2-hg4x Deserialization of Untrusted Data in Jenkins | < 2.138.4 ; 2.140 – < 2.154 | Affected |
| GHSA-hph9-9vcq-f7gp Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.138.4 ; 2.140 – < 2.154 | Affected |
| GHSA-hq87-h4jg-vxfw Jenkins temporary uploaded file created with insecure permissions | 2.50 – < 2.414.2 ; 2.415 – < 2.424 | Not affected |
| GHSA-hv45-5j9h-7fhg Cross-site Scripting in Jenkins | < 2.138.2 ; 2.140 – < 2.146 | Affected |
| GHSA-hvmc-7g2x-r3p9 Jenkins Cross-Site Scripting vulnerability in help icons | < 2.235.4 ; 2.236 – < 2.252 | Affected |
| GHSA-hw55-f8wc-82m6 Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.176.4 ; 2.177 – < 2.197 | Affected |
| GHSA-hxjg-2jvf-h3rx Jenkins's build authorization token is stored and displayed in plain text | 2.529 – < 2.541 ; < 2.528.3 | Affected |
| GHSA-j3cq-h6vh-gx7f Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins | < 2.303.3 ; 2.304 – < 2.319 | Affected |
| GHSA-j472-mcq2-95p6 OS Command Injection in Jenkins | < 2.73.2 ; 2.74 – < 2.84 | Affected |
| GHSA-j664-qhh4-hpf8 Cross-site Scripting vulnerability in Jenkins | 2.376 – < 2.394 ; < 2.375.4 | Affected |
| GHSA-j7q5-h445-f7pc Jenkins allows Execution of Code by Opening a JRMP Listener | 1.643 – < 1.650 ; < 1.642.2 | Affected |
| GHSA-j8qv-mj4r-6fw4 Improper Input Validation in Jenkins | < 2.121.2 ; 2.122 – < 2.132 | Affected |
| GHSA-jff5-55xj-4jcq Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.32.2 ; 2.34 – < 2.44 | Affected |
| GHSA-jgpr-qrw2-6gp3 Exposure of Sensitive Information in Jenkins Core | < 1.650 | Affected |
| GHSA-jmw7-ph6p-33cc Exposure of Sensitive Information in Jenkins Core | < 1.650 | Affected |
| GHSA-jpvq-v729-7j2h Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.235.4 ; 2.237 – < 2.252 | Affected |
| GHSA-jwfr-h6jp-9p2g Jenkins allows attackers to obtain the master cryptographic key | 1.481 – < 1.498 ; < 1.480.2 | Affected |
| GHSA-m6wv-wh8g-64xc Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations | < 2.555.3 ; 2.556 – < 2.568 | Affected |
| GHSA-m93h-5qmx-pphg Improper Authentication in Jenkins | < 2.32.2 ; 2.34 – < 2.44 | Affected |
| GHSA-m9hr-259f-2v23 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins | < 2.303.3 ; 2.304 – < 2.319 | Affected |
| GHSA-mhp7-3393-pfqr Cross-site Scripting vulnerability in Jenkins | 2.340 – < 2.356 ; 2.332 – < 2.332.4 | Not affected |
| GHSA-mj7q-cmf3-mg7h Stored XSS vulnerability in Jenkins on new item page | < 2.263.2 ; 2.264 – < 2.275 | Affected |
| GHSA-mm9c-4cv4-7rfv Jenkins allows for Privilege Escalation by Remote Authenticated Users | 1.597 – < 1.600 ; < 1.596.1 | Affected |
| GHSA-mqgf-4rw4-2cq2 Jenkins affected by Open Redirect Vulnerability | < 1.480.1 ; 1.481 – < 1.491 | Affected |
| GHSA-mw82-xcg6-gx79 Jenkins: Missing permission check allows unauthorized cancellation of queue items | < 2.555.3 ; 2.556 – < 2.568 | Affected |
| GHSA-p265-xr98-3vmr Incorrect Authorization in Jenkins | < 2.121.2 ; 2.122 – < 2.133 | Affected |
| GHSA-p34j-r3ch-c985 Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission | 2.493 – < 2.500 ; < 2.492.2 | Affected |
| GHSA-p3f5-98cv-562j Jenkins is missing a permission check on password fields | 2.529 – < 2.541 ; < 2.528.3 | Affected |
| GHSA-p3rc-946h-8cf5 Unauthorized view fragment access in Jenkins | 2.335 – < 2.356 | Not affected |
| GHSA-p8x8-p473-mmmv Missing Authorization in Jenkins | < 2.73.2 ; 2.74 – < 2.84 | Affected |
| GHSA-p92q-7fhh-mq35 Cross-Site Request Forgery in Jenkins | 2.320 – < 2.330 ; < 2.319.2 | Affected |
| GHSA-pchp-c5w8-47gc Hash collision attack vulnerability in Jenkins | 1.425 – < 1.447 ; < 1.424.2 | Affected |
| GHSA-pgj6-jmj5-wqfx Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins | < 2.303.3 ; 2.304 – < 2.319 | Affected |
| GHSA-pgxv-h967-fw2q Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.121.2 ; 2.122 – < 2.132 | Affected |
| GHSA-phhv-63fh-rrc8 Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation | 2.442 – < 2.555 | Not affected |
| GHSA-pj95-ph4q-4qm4 Jenkins exposes multi-line secrets through error messages | < 2.462.3 ; 2.466 – < 2.479 | Affected |
| GHSA-pv88-j6rg-r56p Jenkins allows attackers to obtain sensitive information | 1.533 – < 1.551 ; < 1.532.2 | Affected |
| GHSA-pvwx-3jx5-24r2 Lack of type validation in agent related REST API in Jenkins | < 2.277.2 ; 2.278 – < 2.287 | Affected |
| GHSA-pwv6-872c-gcg6 Cross-Site Request Forgery in Jenkins | < 2.32.2 ; 2.34 – < 2.44 | Affected |
| GHSA-pxgq-gqr9-5gwx Path traversal vulnerability in Jenkins agent names | < 2.263.2 ; 2.264 – < 2.275 | Affected |
| GHSA-q3rp-555r-hh6r Jenkins allows Cross-Site Scripting (XSS) | < 1.409.3 ; 1.410 – < 1.438 | Affected |
| GHSA-q4cq-r7hg-pxqq Improper Authentication in Jenkins | < 2.121.3 ; 2.122 – < 2.138 | Affected |
| GHSA-q4wp-8c99-69pw Improper permission checks allow canceling queue items and aborting builds in Jenkins | < 2.289.2 ; 2.292 – < 2.300 | Affected |
| GHSA-q5f8-fxrx-pw6f Jenkins subject to Cross-site Scripting | < 1.502 | Affected |
| GHSA-q6q9-83xw-mp6p Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.176.4 ; 2.177 – < 2.197 | Affected |
| GHSA-qf2h-h3xq-j93j Jenkins allows Remote Users to Inject Build Parameters | 1.660 – < 2.3 ; < 1.651.2 | Affected |
| GHSA-qf38-f2fr-q4x9 Improper Input Validation in Jenkins | < 2.121.2 ; 2.122 – < 2.132 | Affected |
| GHSA-qg7x-4h4q-3m49 XML external entity (XXE) vulnerability in Jenkins | 1.597 – < 1.600 ; < 1.596.1 | Affected |
| GHSA-qgj4-rc8m-44mq Stored XSS vulnerability in Jenkins job build time trend | < 2.235.2 ; 2.236 – < 2.245 | Affected |
| GHSA-qj27-w92h-fc9r XML external entity (XXE) vulnerability in Jenkins | 1.597 – < 1.600 ; < 1.596.1 | Affected |
| GHSA-qp4f-2w67-c8hw Inbound TCP Agent Protocol/3 authentication bypass in Jenkins | < 2.204.2 ; 2.205 – < 2.214 | Affected |
| GHSA-qpg9-83fv-x9ch Improper Neutralization of Input During Web Page Generation in Jenkins | < 2.164.2 ; 2.165 – < 2.172 | Affected |
| GHSA-qr42-82qj-mw65 Improper Limitation of a Pathname to a Restricted Directory in Jenkins | < 2.176.2 ; 2.177 – < 2.186 | Affected |
| GHSA-qrh5-jg98-cr48 Jenkins has a log message injection vulnerability | < 2.516.3 ; 2.517 – < 2.528 | Affected |
| GHSA-qv64-w99c-qcr9 Jenkins temporary uploaded file created with insecure permissions | 2.50 – < 2.414.2 ; 2.415 – < 2.424 | Not affected |
| GHSA-qv6f-rcv6-6q3x Improper handling of REST API XML deserialization errors in Jenkins | < 2.263.2 ; 2.264 – < 2.275 | Affected |
| GHSA-qxp6-27gw-99cj Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins | < 2.263.3 ; 2.264 – < 2.276 | Affected |
| GHSA-r2jf-rc5v-vmpv Incorrect Authorization in Jenkins | < 2.121.3 ; 2.122 – < 2.138 | Affected |
| GHSA-r57f-7xw3-q2r9 Improper Authentication in Jenkins | 2.50 – < 2.57 ; < 2.46.2 | Affected |
| GHSA-r5m2-g5gc-q43r Jenkins Denial of Service vulnerability | 1.566 – < 1.583 ; < 1.565.3 | Affected |
| GHSA-r5x3-2446-hrp7 Race Condition in Jenkins | 2.81 – < 2.89.2 ; 2.90 – < 2.95 | Not affected |
| GHSA-r69c-5j7c-vm6q Cross-site Scripting in Jenkins | < 2.32.2 ; 2.34 – < 2.44 | Affected |
| GHSA-r6qv-frpc-q66c Jenkins has a link following vulnerability allows arbitrary file creation | < 2.555 | Affected |
| GHSA-r78q-qgx6-64pp Memory usage graphs accessible to anyone with Overall/Read | < 2.204.2 ; 2.205 – < 2.219 | Affected |
| GHSA-r9q2-3r6x-qmgp Inadequate Encryption Strength in Jenkins | < 2.32.2 ; 2.34 – < 2.44 | Affected |
| GHSA-rfh6-9r2q-98vf Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission | < 2.492.2 ; 2.493 – < 2.500 | Affected |
| GHSA-rgmj-mccj-h9mx Cross-Site Request Forgery in Jenkins | < 2.107.3 ; 2.108 – < 2.121 | Affected |
| GHSA-rqhg-cxfr-8xqw Jenkins Cross-Site Request Forgery vulnerability | 1.481 – < 1.502 ; < 1.480.3 | Affected |
| GHSA-rr6r-p7rw-369c Session Fixation in Jenkins | < 2.138.2 ; 2.140 – < 2.146 | Affected |
| GHSA-rrgp-c2w8-6vg6 Information disclosure through error stack traces related to agents | 2.376 – < 2.387.1 ; < 2.375.4 ; 2.388 – < 2.394 | Affected |
| GHSA-rx4r-gxpc-h85x Jenkins affected by Open Redirect Vulnerability | 1.652 – < 2.3 ; < 1.651.2 | Affected |
| GHSA-rxfv-gm5x-9wqj Jenkin allows attackers to obtain passwords by reading the HTML source code | 1.533 – < 1.551 ; < 1.532.2 | Affected |
| GHSA-v222-w2mw-xjc6 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.32.2 ; 2.34 – < 2.44 | Affected |
| GHSA-v759-3fh9-84mx Jenkins directory traversal vulnerability | 1.533 – < 1.551 ; < 1.532.2 | Affected |
| GHSA-vcr8-h8qp-qj8h Cross-Site Request Forgery in Jenkins | < 2.176.3 ; 2.177 – < 2.192 | Affected |
| GHSA-vj6q-v2h7-6q5m Jenkins cross-site scripting (XSS) vulnerability | 1.533 – < 1.551 ; < 1.532.2 | Affected |
| GHSA-vpjm-58cw-r8q5 Arbitrary file read vulnerability in workspace browsers in Jenkins | < 2.263.2 ; 2.264 – < 2.275 | Affected |
| GHSA-vxc6-wvh8-fpxw Jenkins does not invalidate the API token when a user is deleted | 1.533 – < 1.551 ; < 1.532.2 | Affected |
| GHSA-w2hv-rcqr-2h7r View name validation bypass in Jenkins | < 2.277.2 ; 2.278 – < 2.287 | Affected |
| GHSA-w3f5-gq7j-m797 Jenkins Vulnerable to Clickjacking | 1.533 – < 1.551 ; < 1.532.2 | Affected |
| GHSA-w5v7-q2j4-fvpf Jenkins Cross-site Scripting vulnerability | < 1.596.2 ; 1.600 – < 1.606 | Affected |
| GHSA-w7jr-wqw6-54xc Non-constant time comparison of inbound TCP agent connection secret | < 2.204.2 ; 2.205 – < 2.219 | Affected |
| GHSA-w7qm-fprw-cqgq Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack | 1.626 – < 1.640 ; < 1.625.2 | Affected |
| GHSA-wf9g-rh76-6jvr Incorrect Permission Assignment for Critical Resource in Jenkins | < 2.32.2 ; 2.34 – < 2.44 | Affected |
| GHSA-wfhp-qgm8-5p5c Jenkins has a build information disclosure vulnerability through Run Parameter | 2.542 – < 2.551 ; < 2.541.2 | Affected |
| GHSA-wfj3-535m-p6fx Improper Input Validation in Jenkins | < 2.73.3 ; 2.74 – < 2.89 | Affected |
| GHSA-wj5c-j656-h5fw Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.32.2 ; 2.34 – < 2.44 | Affected |
| GHSA-wmr8-25ff-ggpj Incorrect Authorization in Jenkins | < 2.121.2 ; 2.122 – < 2.132 | Affected |
| GHSA-wqv4-9gr3-3qgh Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.73.2 ; 2.74 – < 2.84 | Affected |
| GHSA-wr6p-j63r-xqhv Jenkins allows Data Insertion and Execution of Code by those with Read and HTTP Access | < 1.466.2 ; 1.467 – < 1.482 | Affected |
| GHSA-wr6w-jxg7-qpfh Jenkins Missing Permission Check | 2.500 – < 2.504 ; < 2.492.3 | Affected |
| GHSA-wv63-gwr9-5c55 Stored XSS vulnerability in Jenkins button labels | < 2.275 ; 2.263.2 – < 2.275 | Affected |
| GHSA-x274-9m9r-fm5g Jenkins does not Verify Checksums for Plugin Files | < 1.625.2 ; 1.626 – < 1.640 | Affected |
| GHSA-x2q2-8pwq-fr5r Jenkins allows Bypass of Access Restrictions | < 1.625.2 ; 1.626 – < 1.638 | Affected |
| GHSA-x3p3-929j-pq66 Improper Neutralization of Input During Web Page Generation in Jenkins | 1.626 – < 1.640 ; < 1.625.2 | Affected |
| GHSA-x3rc-cxv7-6xp6 Cross-site Scripting in Jenkins Core | < 2.94 | Affected |
| GHSA-x4m5-j4x4-4wjg Jenkins allows Administrators to Access API Tokens | < 1.625.2 ; 1.626 – < 1.638 | Affected |
| GHSA-x55p-6526-xmmp Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.32.2 ; 2.34 – < 2.44 | Affected |
| GHSA-x646-m7x2-gcp7 Path Traversal in Jenkins | < 2.107.3 ; 2.108 – < 2.121 | Affected |
| GHSA-x6jw-2f23-mc5j Exposure of Sensitive Information to an Unauthorized Actor in Jenkins | < 2.89.4 ; 2.90 – < 2.107 | Affected |
| GHSA-x97g-3gp9-cf2p Jenkins allows Cross-Site Scripting (XSS) via Crafted URL | < 1.466.2 ; 1.467 – < 1.482 | Affected |
| GHSA-xpvp-h73c-m9rq Jenkins vulnerable to stored cross site scripting in the I:helpIcon component | 2.367 – < 2.370 | Not affected |
Sources
| Source | Licence |
|---|