Filtered by vendor Jenkins Subscriptions
Total 1749 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-28672 1 Jenkins 1 Octoperf Load Testing 2025-02-26 6.5 Medium
Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2023-28671 1 Jenkins 1 Octoperf Load Testing 2025-02-26 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2023-28670 1 Jenkins 1 Pipeline Aggregator View 2025-02-26 5.4 Medium
Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.
CVE-2023-28678 1 Jenkins 1 Cppcheck 2025-02-25 5.4 Medium
Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control report file contents.
CVE-2023-28677 1 Jenkins 1 Convert To Pipeline 2025-02-25 9.8 Critical
Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a convertion by Jenkins Convert To Pipeline Plugin.
CVE-2023-28676 1 Jenkins 1 Convert To Pipeline 2025-02-25 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freestyle project, potentially leading to remote code execution (RCE).
CVE-2023-28669 1 Jenkins 1 Jacoco 2025-02-25 5.4 Medium
Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action.
CVE-2023-28668 1 Jenkins 1 Role-based Authorization Strategy 2025-02-25 9.8 Critical
Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.
CVE-2023-28682 1 Jenkins 1 Performance Publisher 2025-02-25 8.2 High
Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28681 1 Jenkins 1 Visual Studio Code Metrics 2025-02-25 8.2 High
Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28680 1 Jenkins 1 Crap4j 2025-02-25 7.5 High
Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28675 1 Jenkins 1 Octoperf Load Testing 2025-02-25 4.3 Medium
A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.
CVE-2023-28679 1 Jenkins 1 Mashup Portlets 2025-02-24 5.4 Medium
Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expression, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.
CVE-2023-28683 1 Jenkins 1 Phabricator Differential 2025-02-21 8.2 High
Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2023-28684 1 Jenkins 1 Remote-jobs-view 2025-02-21 6.5 Medium
Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2024-23903 1 Jenkins 1 Github Branch Source 2025-02-13 5.3 Medium
Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.
CVE-2023-50779 1 Jenkins 1 Paaslane Estimate 2025-02-13 4.3 Medium
Missing permission checks in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified token.
CVE-2023-50778 1 Jenkins 1 Paaslane Estimate 2025-02-13 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified token.
CVE-2023-50776 1 Jenkins 1 Paaslane Estimate 2025-02-13 4.3 Medium
Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVE-2023-50775 1 Jenkins 1 Deployment Dashboard 2025-02-13 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs.