Vulnerabilidades en Jenkins Project
1613 resultadosCVE-2020-2288—In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to EPSS 1.0%CVE-2021-21662—A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumeraEPSS 0.9%CVE-2022-27217—Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller wheEPSS 0.9%CVE-2017-2649—It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active DirectorEPSS 0.9%CVE-2019-10411—Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuratEPSS 0.9%CVE-2021-21617—A cross-site request forgery (CSRF) vulnerability in Jenkins Configuration Slicing Plugin 1.51 and earlier allows attackers to apply differeEPSS 0.9%CVE-2022-38663—Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the GitEPSS 0.9%CVE-2024-28151MEDIUMJenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the conEPSS 0.9%CVE-2022-41226CRITICALJenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attaEPSS 0.9%CVE-2020-2196—Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrativeEPSS 0.9%CVE-2020-2320—Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.EPSS 0.9%CVE-2019-10459—Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuratiEPSS 0.9%CVE-2020-2138—Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.9%CVE-2020-2119—Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, pEPSS 0.9%CVE-2022-27211—A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission toEPSS 0.9%CVE-2022-28141—Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins conEPSS 0.9%CVE-2022-27216—Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins contrEPSS 0.9%CVE-2022-28135—Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins bEPSS 0.9%CVE-2022-27209—A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission toEPSS 0.9%CVE-2026-57281HIGHJenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions mEPSS 0.9%