JE
DevOps
Jenkins
On CISA KEVExploited in the wildRansomware-linked
286
CVEs
6
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 22High 62Medium 146Low 5
Watch
Add Jenkins to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-1807 | – | Oct 16 | Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink,… Affected: through 1.580.3; through 1.599 |
| CVE-2015-1806 | – | Oct 16 | The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and… Affected: through 1.580.3; through 1.599 |
| CVE-2014-2068 | – | Oct 17 | The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER… Affected: through 1.550; through 1.532.1 |
| CVE-2014-2066 | – | Oct 17 | Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins… Affected: through 1.532.1; through 1.550 |
| CVE-2014-2065 | – | Oct 17 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie Affected: through 1.532.1; through 1.550 |
| CVE-2014-2064 | – | Oct 17 | The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a… Affected: through 1.532.1; through 1.550 |
| CVE-2014-2063 | – | Oct 17 | Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors Affected: through 1.550; through 1.532.1 |
| CVE-2014-2062 | – | Oct 17 | Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token Affected: through 1.532.1; through 1.550 |
| CVE-2014-2061 | – | Oct 17 | The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code,… Affected: through 1.532.1; through 1.550 |
| CVE-2014-2060 | – | Oct 17 | The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors Affected: through 1.550; through 1.532.1 |
| CVE-2014-2058 | – | Oct 17 | BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to… Affected: through 1.532.1; through 1.550 |
| CVE-2013-7330 | – | Oct 17 | Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actions Affected: through 1.501 |
| CVE-2014-3680 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized… Affected: through 1.565.2; through 1.582 |
| CVE-2014-3667 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain… Affected: through 1.582; through 1.565.2 |
| CVE-2014-3666 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel Affected: through 1.582; through 1.565.2 |
| CVE-2014-3663 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary… Affected: through 1.565.2; through 1.582 |
| CVE-2014-3662 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts Affected: through 1.582; through 1.565.2 |
| CVE-2014-3661 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake Affected: through 1.582; through 1.565.2 |
| CVE-2014-3681 | – | Oct 15 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: before 1.565.3; before 1.583 |
| CVE-2014-3664 | – | Oct 15 | Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via… Affected: through 1.565.2; through 1.582 |
| CVE-2013-2033 | – | Apr 10 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote… Affected: before 1.509.1; before 1.514 |
| CVE-2014-2067 | – | Mar 1 | Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web… Affected: through 1.550; through 1.532.1 |
| CVE-2014-2059 | – | Mar 1 | Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to… Affected: through 1.532.1; through 1.550 |
| CVE-2013-5573 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field… Affected: 1.523 |
| CVE-2013-0331 | – | Mar 19 | Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload Affected: through 1.480.2; through 1.501 |
| CVE-2013-0330 | – | Mar 19 | Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors Affected: through 1.480.2; through 1.501 |
| CVE-2013-0329 | – | Mar 19 | Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors Affected: through 1.480.2; through 1.501 |
| CVE-2013-0328 | – | Mar 19 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 1.501; through 1.480.2 |
| CVE-2013-0327 | – | Mar 19 | Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via… Affected: through 1.501; through 1.480.2 |
| CVE-2013-0158 | – | Feb 24 | Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is… Affected: 1.400; 1.401; 1.402; 1.403; 1.404; 1.405; +34 more |
| CVE-2012-6074 | – | Feb 24 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and… Affected: 1.400; 1.401; 1.402; 1.403; 1.404; 1.405; +34 more |
| CVE-2012-6073 | – | Feb 24 | Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before… Affected: through 1.466.2; 1.409.1; 1.409.2; 1.409.3; 1.424.1; 1.424.2; +34 more |
| CVE-2012-6072 | – | Feb 24 | CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before… Affected: through 1.466.2; 1.409.1; 1.409.2; 1.409.3; 1.424.1; 1.424.2; +34 more |
| CVE-2012-0325 | – | Mar 9 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows… Affected: 1.301; 1.302; 1.303; 1.304; 1.305; 1.306; +34 more |
| CVE-2012-0324 | – | Mar 9 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows… Affected: 1.301; 1.302; 1.303; 1.304; 1.305; 1.306; +34 more |
| CVE-2011-4344 | – | Dec 1 | Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers… Affected: 1.409.1; 1.409.2; through 1.437 |