Jenkins Project vulnerabilities
Published CVEs affecting Jenkins Project products: 170 record(s), with severity, exploitation and fixes.
Jenkins 36Jenkins Script Security Plugin 14Jenkins Gitee Plugin 4Jenkins LDAP Plugin 3Jenkins Active Directory Plugin 3Jenkins Pipeline: Groovy Libraries Plugin 3Jenkins Multijob Plugin 3Jenkins Publish to Bitbucket Plugin 3Jenkins Pipeline: Groovy Plugin 3Jenkins Assembla Plugin 3Jenkins Contrast Continuous Application Security Plugin 3Jenkins Parameterized Remote Trigger Plugin 2Jenkins SCM-Manager Plugin 2Jenkins Coverage Plugin 2Jenkins Nexus Task Runner Plugin 2Jenkins SAML Plugin 2Jenkins Themis Plugin 2Jenkins Pipeline: Build Step Plugin 2Jenkins Microsoft Entra ID (previously Azure AD) Plugin 2Jenkins LoadNinja Plugin 2Jenkins GitLab Plugin 2Jenkins Zowe zDevOps Plugin 2Jenkins External Workspace Manager Plugin 2Jenkins Credentials Binding Plugin 2Jenkins GitHub Branch Source Plugin 2Jenkins Curseforge Publisher Plugin 2Jenkins MCP Server Plugin 2Jenkins Start Windocks Containers Plugin 2Jenkins ByteGuard Build Actions Plugin 2Jenkins EC2 Fleet Plugin 2Jenkins Git client Plugin 2Jenkins Job Configuration History Plugin 2Jenkins Bitbucket Push and Pull Request Plugin 2Jenkins AWS CodeBuild Plugin 1Jenkins CodeSonar Plugin 1Jenkins Horreum Plugin 1Jenkins Ivy Report Plugin 1Jenkins Priority Sorter Plugin 1Jenkins Sauce OnDemand Plugin 1Jenkins Git Parameter Plugin 1
CVE-2025-64147
Medium · 4.3
CWE-311 Oct 29, 2025
Missing Encryption of Sensitive Data in Jenkins Curseforge Publisher
Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2025-64146
Medium · 4.3
CWE-311 Oct 29, 2025
Missing Encryption of Sensitive Data in Jenkins Curseforge Publisher
Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
CVE-2025-64145
Medium · 4.3
CWE-311 Oct 29, 2025
Missing Encryption of Sensitive Data in Jenkins Byteguard Build Actions
Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2025-64144
Medium · 4.3
CWE-311 Oct 29, 2025
Missing Encryption of Sensitive Data in Jenkins Byteguard Build Actions
Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
CVE-2025-64143
Medium · 4.3
CWE-311 Oct 29, 2025
Missing Encryption of Sensitive Data in Jenkins Openshift Pipeline
Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
CVE-2025-64142
Medium · 4.3
CWE-862 Oct 29, 2025
Missing Authorization in Jenkins Nexus Task Runner
A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2025-64141
Medium · 4.3
CWE-352 Oct 29, 2025
Cross-Site Request Forgery (CSRF) in Jenkins Nexus Task Runner
A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2025-64140
High · 8.8
CWE-78 Oct 29, 2025
OS Command Injection in Jenkins Azure Cli
Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands.
CVE-2025-64139
Medium · 4.3
CWE-862 Oct 29, 2025
Missing Authorization in Jenkins Start Windocks Container
A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2025-64138
Medium · 4.3
CWE-352 Oct 29, 2025
Cross-Site Request Forgery (CSRF) in Jenkins Start Windocks Container
A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.
CVE-2025-64137
Medium · 4.3
CWE-862 Oct 29, 2025
Missing Authorization in Jenkins Themis
A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
CVE-2025-64136
Medium · 4.3
CWE-352 Oct 29, 2025
Cross-Site Request Forgery (CSRF) in Jenkins Themis
A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.
CVE-2025-64135
Medium · 5.9
CWE-1188 Oct 29, 2025
Insecure Default Initialization of Resource in Jenkins Eggplant Runner
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime.
CVE-2025-64134
High · 7.1
CWE-611 Oct 29, 2025
XML External Entity (XXE) in Jenkins Jdepend
Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2025-64133
Medium · 5.4
CWE-352 Oct 29, 2025
Cross-Site Request Forgery (CSRF) in Jenkins Extensible Choice Parameter
A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code.
CVE-2025-64132
Medium · 5.4
CWE-862 Oct 29, 2025
Missing Authorization in Jenkins Mcp Server
Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access.
CVE-2025-64131
High · 7.5
CWE-294 Oct 29, 2025
Authentication Bypass by Capture-replay in Jenkins Saml
Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, authenticating to Jenkins as that user.
CVE-2024-23897
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-22 Jan 24, 2024
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
CVE-2019-1003030
Critical · 9.9
KEV Urgent · 78 Public exploit CWE-693 Mar 8, 2019
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
CVE-2019-1003029
Critical · 9.9
KEV Urgent · 72 Public exploit Mar 8, 2019
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.