Exposición de Jenkins

CI
44
score de exposición
14
sitios usan
1
en explotación
3
críticos

CVEs

174 resultados
CVE-2017-2612MEDIUMIn Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in futuEPSS 1.5%CVE-2022-34172—In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in EPSS 1.5%CVE-2022-34173—In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job displayEPSS 1.5%CVE-2019-1010241—Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: AuthenticEPSS 1.5%CVE-2021-21607—Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attacEPSS 1.5%CVE-2017-2610MEDIUMjenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping userEPSS 1.4%CVE-2021-21687—Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symEPSS 1.4%CVE-2015-1811—XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XEPSS 1.4%CVE-2015-1809—XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XEPSS 1.4%CVE-2021-21688—The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject aEPSS 1.4%CVE-2022-34175—Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing somEPSS 1.4%CVE-2020-2102—Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.EPSS 1.4%CVE-2020-2101—Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which EPSS 1.4%CVE-2019-10383—A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer EPSS 1.4%CVE-2021-21609—Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing EPSS 1.3%CVE-2019-1003050—The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 aEPSS 1.3%CVE-2017-2604MEDIUMIn Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently pEPSS 1.3%CVE-2020-2161—Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label exprEPSS 1.2%CVE-2021-21606—Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existeEPSS 1.2%CVE-2021-21610—Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup pEPSS 1.2%