HuntersHunters
Sign inStart free
All projects

Security context

What an agent needs to avoid regressing past fixes — and find the next bug in this project.

Jenkins
jenkinsci/jenkins

The leading open-source automation server.

Maven · org.jenkins-ci.main:jenkins-core
259
Advisories
259
CVEs
Critical
Peak severity
226
With fix diff

Distribution

By severity

Critical
19
High
62
Medium
158
Low
20

By weakness class

Other
59
Cross-site Scripting
51
Auth / Access Control
39
Information Disclosure
32
Path Traversal
19
CSRF
17
Improper Validation
16
Deserialization
9
Open Redirect
5
Denial of Service
3

Every fixed vulnerability (259)

Critical15 fixed
CriticalArbitrary file read vulnerability through the Jenkins CLI can lead to RCE2y agoCriticalMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins4y agoCriticalMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins4y agoCriticalMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins4y agoCriticalMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins4y agoCriticalMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins4y agoCriticalMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins4y agoCriticalMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins4y agoCriticalMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins4y agoCriticalMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins4y agoCriticalMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins4y agoCriticalAgent-to-controller access control allows reading/writing most content of build directories in Jenkins4y agoCriticalMultiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins4y agoCriticalExposure of Sensitive Information to an Unauthorized Actor in Jenkins4y agoCriticalJenkins allows Execution of Code by Opening a JRMP Listener4y ago
High37 fixed
HighJenkins: Stored XSS vulnerability in node offline cause description 2mo agoHighJenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation2mo agoHighJenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation5mo agoHighJenkins has a link following vulnerability allows arbitrary file creation5mo agoHighJenkins has a stored XSS vulnerability in node offline cause description6mo agoHighJenkins has a Denial of service vulnerability in HTTP-based CLI8mo agoHighJenkins Remoting library arbitrary file read vulnerability2y agoHighCross-site WebSocket hijacking vulnerability in the Jenkins CLI2y agoHighJenkins temporary plugin file created with insecure permissions 2y agoHighJenkins Cross-site Scripting vulnerability2y agoHighJenkins Stored Cross-site Scripting vulnerability 3y agoHighJenkins CSRF protection bypass vulnerability3y agoHighDenial of service in Jenkins Core3y agoHighIncorrect Authorization in Jenkins Core3y agoHighCross-site Scripting vulnerability in Jenkins3y agoHighJenkins vulnerable to stored cross site scripting in the I:helpIcon component3y agoHighCross-site Scripting vulnerability in Jenkins4y agoHighCross-site Scripting vulnerability in Jenkins4y agoHighCross-site Scripting vulnerability in Jenkins4y agoHighCross-site Scripting vulnerability in Jenkins4y agoHighUnauthorized view fragment access in Jenkins4y agoHighAgent-to-controller access control allowed writing to sensitive directory used by Jenkins Pipeline: Shared Groovy Libraries Plugin4y agoHighSession fixation vulnerability in Jenkins4y agoHighPath traversal vulnerability in Jenkins agent names4y agoHighImproper handling of REST API XML deserialization errors in Jenkins4y agoHighJenkins Cross-site Scripting vulnerability in project naming strategy4y agoHighJenkins Cross-Site Scripting vulnerability in help icons4y agoHighStored XSS vulnerability in Jenkins 'keep forever' badge icon4y agoHighStored XSS vulnerability in Jenkins upstream cause4y agoHighStored XSS vulnerability in Jenkins console links4y agoHighStored XSS vulnerability in Jenkins job build time trend4y agoHighCross-Site Request Forgery in Jenkins4y agoHighInbound TCP Agent Protocol/3 authentication bypass in Jenkins4y agoHighXML external entity (XXE) vulnerability in Jenkins4y agoHighXML external entity (XXE) vulnerability in Jenkins4y agoHighCross-Site Request Forgery in Jenkins4y agoHighCross-Site Request Forgery in Jenkins4y ago
Medium87 fixed
MediumJenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL2mo agoMediumJenkins Open Redirect Through Newline/Tab Characters in Redirect URL2mo agoMediumJenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"2mo agoMediumJenkins exposes other users' timezone and view names to users with Overall/Read permission2mo agoMediumJenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations2mo agoMediumJenkins: Missing permission check allows unauthorized cancellation of queue items2mo agoMediumJenkins has a build information disclosure vulnerability through Run Parameter 6mo agoMediumJenkins's build authorization token is stored and displayed in plain text8mo agoMediumJenkins's build authorization token is stored and displayed in plain text8mo agoMediumJenkins is missing a permission check on password fields8mo agoMediumJenkins is missing a permission check in the authenticated users' profile menu 11mo agoMediumJenkins has a missing permission check, allowing users to obtain agent names11mo agoMediumJenkins has a log message injection vulnerability11mo agoMediumJenkins Missing Permission Check1y agoMediumJenkins Missing Permission Check1y agoMediumJenkins cross-site request forgery (CSRF) vulnerability1y agoMediumJenkins Open Redirect vulnerability 1y agoMediumJenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission1y agoMediumJenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission1y agoMediumJenkins item creation restriction bypass vulnerability1y agoMediumJenkins exposes multi-line secrets through error messages1y agoMediumJenkins does not perform a permission check in an HTTP endpoint2y agoMediumJenkins does not exclude sensitive build variables from search2y agoMediumIncorrect Permission Preservation in Jenkins Core3y agoMediumDenial of service in Jenkins Core3y agoMediumObservable timing discrepancy allows determining username validity in Jenkins4y agoMediumImproper Neutralization of Input During Web Page Generation in Jenkins4y agoMediumExposure of Sensitive Information to an Unauthorized Actor in Jenkins4y agoMediumImproper Neutralization of Input During Web Page Generation in Jenkins4y agoMediumImproper Neutralization of Input During Web Page Generation in Jenkins4y agoMediumImproper Neutralization of Input During Web Page Generation in Jenkins4y agoMediumImproper Neutralization of Input During Web Page Generation in Jenkins4y agoMediumPath traversal vulnerability on Windows in Jenkins4y agoMediumImproper handling of equivalent directory names on Windows in Jenkins4y agoMediumImproper permission checks allow canceling queue items and aborting builds in Jenkins4y agoMediumLack of type validation in agent related REST API in Jenkins4y agoMediumView name validation bypass in Jenkins4y agoMediumTime-of-check Time-of-use (TOCTOU) Race Condition in Jenkins4y agoMediumReflected XSS vulnerability in Jenkins markup formatter preview4y agoMediumExcessive memory allocation in graph URLs leads to denial of service in Jenkins4y agoMediumStored XSS vulnerability in Jenkins on new item page4y agoMediumMissing permission check for paths with specific prefix in Jenkins4y agoMediumXSS vulnerability in Jenkins notification bar4y agoMediumArbitrary file existence check in file fingerprints in Jenkins4y agoMediumArbitrary file read vulnerability in workspace browsers in Jenkins4y agoMediumStored XSS vulnerability in Jenkins button labels4y agoMediumImproper Neutralization of Input During Web Page Generation in Jenkins4y agoMediumImproper Neutralization of Input During Web Page Generation in Jenkins4y agoMediumImproper Neutralization of Input During Web Page Generation in Jenkins4y agoMediumImproper Neutralization of Input During Web Page Generation in Jenkins4y agoMediumJenkins Diagnostic page exposed session cookies4y agoMediumNon-constant time HMAC comparison4y agoMediumJenkins vulnerable to UDP amplification reflection attack4y agoMediumMemory usage graphs accessible to anyone with Overall/Read4y agoMediumNon-constant time comparison of inbound TCP agent connection secret4y agoMediumImproper Neutralization of Input During Web Page Generation in Jenkins4y agoMediumMissing Authorization in Jenkins4y agoMediumImproper Limitation of a Pathname to a Restricted Directory in Jenkins4y agoMediumJenkins allows attackers to execute arbitrary jobs4y agoMediumJenkins allows Remote Attackers to Hijack Sessions4y agoMediumJenkins allows attackers to configure restricted projects4y agoMediumJenkin allows attackers to obtain passwords by reading the HTML source code4y agoMediumJenkins does not invalidate the API token when a user is deleted4y agoMediumJenkins Vulnerable to Clickjacking4y agoMediumJenkins allows attackers to determine whether a user exists4y agoMediumJenkins session fixation vulnerability4y agoMediumJenkins cross-site scripting (XSS) vulnerability4y agoMediumJenkins Denial of Service vulnerability4y agoMediumImproper Neutralization of Input During Web Page Generation in Jenkins4y agoMediumJenkins allows remote authenticated users to bypass intended restrictions and create or destroy arbitrary jobs4y agoMediumJenkins improperly ensures trust separation4y agoMediumJenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability4y agoMediumJenkins allows for Code Execution via Crafted Packet to the CLI4y agoMediumJenkins does not Restrict Reserved Names Allowing for Privilege Escalation 4y agoMediumJenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code4y agoMediumJenkins allows for Privilege Escalation by Remote Authenticated Users4y agoMediumJenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability4y agoMediumJenkins allows for Privilege Escalation by Remote Authenticated Users4y agoMediumJenkins Cross-site Scripting vulnerability4y agoMediumJenkins Cross-Site Request Forgery vulnerabilities4y agoMediumJenkins directory traversal vulnerability4y agoMediumJenkins cross-site scripting (XSS) vulnerability4y agoMediumJenkins Path Traversal vulnerability4y agoMediumJenkins HttpOnly flag not Set for session cookies4y agoMediumJenkins secure flag not set on session cookies4y agoMediumCross-site Scripting in Jenkins Core4y agoMediumJenkins has CRLF Injection Vulnerability in the CLI4y ago
Low11 fixed
LowJenkins has a CSRF vulnerability on the login form8mo agoLowJenkins temporary uploaded file created with insecure permissions2y agoLowJenkins temporary uploaded file created with insecure permissions2y agoLowIncorrect Authorization in Jenkins Core3y agoLow Information disclosure through error stack traces related to agents 3y agoLowJenkins REST APIs vulnerable to clickjacking4y agoLowJenkins allows Cross-Site Scripting (XSS)4y agoLowJenkins allows attackers to obtain sensitive information4y agoLowJenkins allows Cross-Site Scripting (XSS)4y agoLowJenkins Vulnerable to Denial of Service (DoS)4y agoLowJenkins allows Cross-Site Scripting (XSS) in User Configuration4y ago

Showing the 150 most recent of 259.