AD
Product
Active Directory
12
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 2Medium 6Low 1
Watch
Add Active Directory to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-2301 | 9.8 | Nov 4 | Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional… Affected: through 2.19 |
| CVE-2020-2300 | 9.8 | Nov 4 | Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user… Affected: through 2.19 |
| CVE-2020-2299 | 9.8 | Nov 4 | Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password Affected: through 2.19 |
| CVE-2017-2649 | 8.1 | Jul 27 | It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling… Affected: through 2.2 |
| CVE-2019-1003009 | 7.4 | Feb 6 | An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in… Affected: through 2.10 |
| CVE-2026-48919 | 6.6 | May 27 | Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation Affected: through 2.41 |
| CVE-2026-48918 | 6.6 | May 27 | Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default Affected: through 2.41 |
| CVE-2022-23105 | 6.5 | Jan 12 | Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations Affected: through 2.25 |
| CVE-2023-37943 | 5.9 | Jul 12 | Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing… Affected: through 2.30 |
| CVE-2020-2303 | 4.3 | Nov 4 | A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to… Affected: through 2.19 |
| CVE-2020-2302 | 4.3 | Nov 4 | A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page Affected: through 2.19 |
| CVE-2026-57288 | 3.7 | Jun 24 | Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing… Affected: before 2.41.2 |
Showing 12