Filtered by vendor Jenkins Subscriptions
Total 1714 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-53678 1 Jenkins 1 User1st Utester 2025-10-03 6.5 Medium
Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
CVE-2025-24397 1 Jenkins 1 Gitlab 2025-10-03 4.3 Medium
An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credential IDs of GitLab API token and Secret text credentials stored in Jenkins.
CVE-2025-24400 1 Jenkins 1 Eiffel Broadcaster 2025-10-03 4.3 Medium
Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers able to create a credential with the same ID as a legitimate one in a different credentials store to sign an event published to RabbitMQ with the legitimate credentials.
CVE-2025-24401 1 Jenkins 1 Folder-based Authorization Strategy 2025-10-03 6.8 Medium
Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they're no longer entitled to.
CVE-2025-24402 1 Jenkins 1 Azure Service Fabric 2025-10-03 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a Service Fabric URL using attacker-specified credentials IDs obtained through another method.
CVE-2025-24403 1 Jenkins 1 Azure Service Fabric 2025-10-03 4.3 Medium
A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of Azure credentials stored in Jenkins.
CVE-2025-59474 1 Jenkins 1 Jenkins 2025-10-02 5.3 Medium
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.
CVE-2025-59475 1 Jenkins 1 Jenkins 2025-10-02 4.3 Medium
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).
CVE-2025-59476 1 Jenkins 1 Jenkins 2025-10-02 5.3 Medium
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.
CVE-2025-53671 1 Jenkins 1 Nouvola Divecloud 2025-10-01 6.5 Medium
Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2025-53672 1 Jenkins 1 Kryptowire 2025-10-01 6.5 Medium
Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
CVE-2025-53673 1 Jenkins 1 Sensedia Api Platform Tools 2025-10-01 6.5 Medium
Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
CVE-2025-53674 1 Jenkins 1 Sensedia Api Platform Tools 2025-10-01 5.3 Medium
Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, increasing the potential for attackers to observe and capture it.
CVE-2025-53675 1 Jenkins 1 Warrior Framework 2025-10-01 6.5 Medium
Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVE-2024-2216 1 Jenkins 1 Docker-build-step 2025-09-18 8.8 High
A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions.
CVE-2024-2215 1 Jenkins 1 Docker-build-step 2025-09-18 6.1 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions.
CVE-2024-28152 1 Jenkins 1 Bitbucket Branch Source 2025-09-18 6.3 Medium
In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.
CVE-2024-28157 1 Jenkins 1 Gitbucket 2025-09-18 8.0 High
Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
CVE-2025-5806 1 Jenkins 1 Gatling 2025-09-17 8 High
Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625, resulting in a cross-site scripting (XSS) vulnerability exploitable by users able to change report content.
CVE-2025-53743 1 Jenkins 1 Applitools Eyes 2025-09-10 5.3 Medium
Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.