Vulnerabilidades de Jenkins Project
CVEs publicadas que afetam produtos de Jenkins Project: 94 registro(s), com severidade, exploração e correções.
Jenkins 18Jenkins Script Security Plugin 4Jenkins Contrast Continuous Application Security Plugin 3Jenkins Assembla Plugin 3Jenkins Pipeline: Groovy Plugin 3Jenkins Gitee Plugin 3Jenkins Publish to Bitbucket Plugin 3Jenkins Active Directory Plugin 3Jenkins ByteGuard Build Actions Plugin 2Jenkins LoadNinja Plugin 2Jenkins Zowe zDevOps Plugin 2Jenkins Nexus Task Runner Plugin 2Jenkins EC2 Fleet Plugin 2Jenkins Themis Plugin 2Jenkins Git client Plugin 2Jenkins Start Windocks Containers Plugin 2Jenkins MCP Server Plugin 2Jenkins Curseforge Publisher Plugin 2Jenkins GitHub Branch Source Plugin 2Jenkins LDAP Plugin 2Jenkins Credentials Binding Plugin 2Jenkins HTML Publisher Plugin 1Jenkins GitHub Plugin 1Jenkins Microsoft Entra ID (previously Azure AD) Plugin 1Jenkins Matrix Authorization Strategy Plugin 1Jenkins OpenShift Pipeline Plugin 1Jenkins JDepend Plugin 1Jenkins Redpen - Pipeline Reporter for Jira Plugin 1Jenkins Azure CLI Plugin 1Jenkins SAML Plugin 1Jenkins Extensible Choice Parameter Plugin 1Jenkins Eggplant Runner Plugin 1Jenkins Coverage Plugin 1Jenkins Multijob Plugin 1Jenkins buildgraph-view Plugin 1Jenkins GitHub Integration Plugin 1Jenkins Pipeline: Groovy Libraries Plugin 1Jenkins AppSpider Plugin 1Jenkins Bitbucket OAuth Plugin 1Jenkins Job Import Plugin 1
CVE-2026-57307
Média · 4.2
CWE-862 24/06/2026
Missing Authorization em Jenkins Zowe Zdevops
A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2026-57306
Média · 4.2
CWE-352 24/06/2026
Cross-Site Request Forgery (CSRF) em Jenkins Zowe Zdevops
A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2026-57305
Média · 5.4
CWE-352 24/06/2026
Cross-Site Request Forgery (CSRF) em Jenkins Assembla
A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password.
CVE-2026-57304
Média · 5.4
CWE-862 24/06/2026
Missing Authorization em Jenkins Assembla
A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.
CVE-2026-57303
Alta · 7.1
CWE-918 24/06/2026
Server-Side Request Forgery (SSRF) em Jenkins Assembla
Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.
CVE-2026-57302
Média · 4.3
CWE-256 24/06/2026
Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml…
Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system.
CVE-2026-57301
Alta · 8.8
CWE-610 24/06/2026
Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins…
Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
CVE-2026-57300
Média · 4.3
CWE-862 24/06/2026
Missing Authorization em Jenkins Mcp Server
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.
CVE-2026-57299
Média · 4.3
CWE-862 24/06/2026
Missing Authorization em Jenkins Contrast Continuous Application Security
Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata.
CVE-2026-57298
Média · 5.4
CWE-352 24/06/2026
Cross-Site Request Forgery (CSRF) em Jenkins Project Jenkins Contrast Continuous Application Security Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers to have Jenkins connect to an attacker-specified URL using an attacker-specified username, API key, and service key.
CVE-2026-57297
Média · 4.3
CWE-862 24/06/2026
Missing Authorization em Jenkins Contrast Continuous Application Security
A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key.
CVE-2026-57296
Alta · 8.8
CWE-22 24/06/2026
Path Traversal em Jenkins Project Jenkins External Workspace Manager Plugin
Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution.
CVE-2026-57295
Média · 5.4
CWE-352 24/06/2026
Cross-Site Request Forgery (CSRF) em Jenkins Ec2 Fleet
A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.
CVE-2026-57294
Média · 5.4
CWE-862 24/06/2026
Missing Authorization em Jenkins Ec2 Fleet
A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.
CVE-2026-57293
Média · 4.3
CWE-862 24/06/2026
Missing Authorization em Jenkins Project Jenkins Gitee Plugin
An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2026-57292
Média · 5.4
CWE-352 24/06/2026
Cross-Site Request Forgery (CSRF) em Jenkins Project Jenkins Gitee Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
CVE-2026-57291
Média · 5.4
CWE-862 24/06/2026
Missing Authorization em Jenkins Project Jenkins Gitee Plugin
Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
CVE-2026-57290
Média · 4.3
CWE-352 24/06/2026
Cross-Site Request Forgery (CSRF) em Jenkins Priority Sorter
A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.
CVE-2026-57289
Média · 4.8
CWE-295 24/06/2026
Improper Certificate Validation em Jenkins Bitbucket Push And Pull Request
Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to capture the token.
CVE-2026-57288
Baixa · 3.7
CWE-90 24/06/2026
LDAP Injection em Jenkins Active Directory
Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.
CVE-2026-57287
Média · 4.3
CWE-312 24/06/2026
Cleartext Storage of Sensitive Information em Jenkins Job Configuration History
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.
CVE-2026-57286
Média · 4.3
CWE-862 24/06/2026
Missing Authorization em Jenkins Git Parameter
A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such as branch names, tag names, and revision metadata.
CVE-2026-57285
Média · 4.3
CWE-862 24/06/2026
Missing Authorization em Jenkins Github Branch Source
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.
CVE-2026-57284
Média · 4.3
CWE-470 24/06/2026
Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the…
Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline steps.
CVE-2026-57283
Média · 4.3
CWE-352 24/06/2026
Cross-Site Request Forgery (CSRF) em Jenkins Pipeline: Groovy
A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or system configuration other than Pipeline steps through the Pipeline Snippet Generator.