Jenkins

Jenkins

260 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2019-1003050

  • EPSS 0.93%
  • Veröffentlicht 10.04.2019 21:29:01
  • Zuletzt bearbeitet 21.11.2024 04:17:48

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to c...

6.5

CVE-2018-1000997

  • EPSS 1.92%
  • Veröffentlicht 23.01.2019 22:29:00
  • Zuletzt bearbeitet 21.11.2024 03:40:36

A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java...

7.2

CVE-2019-1003003

  • EPSS 1.95%
  • Veröffentlicht 22.01.2019 14:29:00
  • Zuletzt bearbeitet 21.11.2024 04:17:43

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember M...

7.2

CVE-2019-1003004

  • EPSS 1.74%
  • Veröffentlicht 22.01.2019 14:29:00
  • Zuletzt bearbeitet 21.11.2024 04:17:43

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indef...

6.5

CVE-2018-1000406

  • EPSS 9.26%
  • Veröffentlicht 09.01.2019 23:29:02
  • Zuletzt bearbeitet 21.11.2024 03:39:59

A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that allows attackers with Job/Configure permission to define a file parameter with a file name out...

6.1

CVE-2018-1000407

  • EPSS 0.31%
  • Veröffentlicht 09.01.2019 23:29:02
  • Zuletzt bearbeitet 21.11.2024 03:40:00

A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML...

6.5

CVE-2018-1000408

  • EPSS 0.15%
  • Veröffentlicht 09.01.2019 23:29:02
  • Zuletzt bearbeitet 21.11.2024 03:40:00

A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that allows attackers without Overall/Read permission to access a specific URL on ins...

5.8

CVE-2018-1000409

  • EPSS 0.07%
  • Veröffentlicht 09.01.2019 23:29:02
  • Zuletzt bearbeitet 21.11.2024 03:40:00

A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that prevented Jenkins from invalidating the existing session and creating a new one w...

7.8

CVE-2018-1000410

  • EPSS 0.13%
  • Veröffentlicht 09.01.2019 23:29:02
  • Zuletzt bearbeitet 21.11.2024 03:40:00

An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descript...

10

CVE-2018-1000861

Warnung
  • EPSS 94.47%
  • Veröffentlicht 10.12.2018 14:29:01
  • Zuletzt bearbeitet 05.11.2025 19:23:34

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java object...