Filtered by vendor Jenkins Subscriptions
Total 1714 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-39458 1 Jenkins 1 Structs 2025-10-10 3.1 Low
When Jenkins Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that may contain secrets passed as step parameters, potentially resulting in accidental exposure of secrets through the default system log.
CVE-2024-5273 1 Jenkins 1 Report Info 2025-10-10 4.3 Medium
Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item/Configure permission to retrieve Surefire failures, PMD violations, Findbugs bugs, and Checkstyle errors on the controller file system by editing the workspace path.
CVE-2024-34147 1 Jenkins 2 Jenkins-telegram-bot, Telegram Bot 2025-10-10 4.3 Medium
Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2024-34146 1 Jenkins 1 Git Server 2025-10-10 6.5 Medium
Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, allowing attackers with a previously configured SSH public key but lacking Overall/Read permission to access these repositories.
CVE-2024-34145 2 Jenkins, Redhat 2 Script Security, Ocp Tools 2025-10-10 8.8 High
A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVE-2024-34144 2 Jenkins, Redhat 2 Script Security, Ocp Tools 2025-10-10 9.8 Critical
A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVE-2025-30197 1 Jenkins 1 Zoho Qengine 2025-10-10 3.1 Low
Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it.
CVE-2024-52550 2 Jenkins, Redhat 3 Groovy, Pipeline\, Ocp Tools 2025-10-10 8 High
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.
CVE-2024-52549 2 Jenkins, Redhat 2 Script Security, Ocp Tools 2025-10-10 4.3 Medium
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.
CVE-2024-39460 1 Jenkins 1 Bitbucket Branch Source 2025-10-10 4.3 Medium
Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.
CVE-2024-39459 1 Jenkins 1 Plain Credentials 2025-10-10 4.3 Medium
In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials).
CVE-2024-52551 3 Jenkins, Jenkins Project, Redhat 3 Pipeline\, Jenkins Pipeline Declaratrive Plugin, Ocp Tools 2025-10-08 8 High
Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved.
CVE-2025-30196 1 Jenkins 1 Anchorchain 2025-10-08 6.5 Medium
Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control the input file for the Anchor Chain post-build step.
CVE-2017-1000353 2 Jenkins, Oracle 2 Jenkins, Communications Cloud Native Core Automated Test Suite 2025-10-03 9.8 Critical
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
CVE-2024-52552 2 Jenkins, Jenkins Project 2 Authorize Project, Jenkins Authorize Project Plugin 2025-10-03 8 High
Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2024-52554 1 Jenkins 1 Shared Library Version Override 2025-10-03 8.8 High
Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed in the Script Security sandbox, allowing attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection.
CVE-2024-54003 2 Jenkins, Jenkins Project 2 Simple Queue, Jenkins Simple Queue Plugin 2025-10-03 8 High
Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.
CVE-2024-54004 1 Jenkins 1 Filesystem List Parameter 2025-10-03 4.3 Medium
Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allowing attackers with Item/Configure permission to enumerate file names on the Jenkins controller file system.
CVE-2025-53676 1 Jenkins 1 Xooa 2025-10-03 6.5 Medium
Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
CVE-2025-53677 1 Jenkins 1 Xooa 2025-10-03 5.3 Medium
Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to observe and capture it.