Vulnerabilidades en Jenkins Project
1613 resultadosCVE-2021-21633—A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to EPSS 0.8%CVE-2022-34784—Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS)EPSS 0.8%CVE-2022-30962—Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameterEPSS 0.8%CVE-2022-36902—Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulEPSS 0.8%CVE-2023-35142HIGHJenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default.EPSS 0.8%CVE-2022-30966—Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displayEPSS 0.8%CVE-2019-10319—A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest alloEPSS 0.8%CVE-2019-10427—Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuratEPSS 0.8%CVE-2022-34198—Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displayEPSS 0.8%CVE-2022-41246MEDIUMA missing permission check in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers with Overall/Read permissionEPSS 0.8%CVE-2023-24433MEDIUMMissing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to aEPSS 0.8%CVE-2023-39152—Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asEPSS 0.8%CVE-2023-24438MEDIUMA missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permisEPSS 0.8%CVE-2022-30964—Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying EPSS 0.8%CVE-2023-28680HIGHJenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.8%CVE-2022-27205—A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read perEPSS 0.8%CVE-2022-34802—Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration filEPSS 0.8%CVE-2020-2296—A cross-site request forgery (CSRF) vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared objEPSS 0.8%CVE-2020-2321—A cross-site request forgery (CSRF) vulnerability in Jenkins Shelve Project Plugin 3.0 and earlier allows attackers to shelve, unshelve, or EPSS 0.8%CVE-2022-43435MEDIUMJenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in worEPSS 0.8%