Vulnerabilidades de Jenkins Project
CVEs publicadas que afetam produtos de Jenkins Project: 170 registro(s), com severidade, exploração e correções.
Jenkins 36Jenkins Script Security Plugin 14Jenkins Gitee Plugin 4Jenkins LDAP Plugin 3Jenkins Active Directory Plugin 3Jenkins Pipeline: Groovy Libraries Plugin 3Jenkins Multijob Plugin 3Jenkins Publish to Bitbucket Plugin 3Jenkins Pipeline: Groovy Plugin 3Jenkins Assembla Plugin 3Jenkins Contrast Continuous Application Security Plugin 3Jenkins Parameterized Remote Trigger Plugin 2Jenkins SCM-Manager Plugin 2Jenkins Coverage Plugin 2Jenkins Nexus Task Runner Plugin 2Jenkins SAML Plugin 2Jenkins Themis Plugin 2Jenkins Pipeline: Build Step Plugin 2Jenkins Microsoft Entra ID (previously Azure AD) Plugin 2Jenkins LoadNinja Plugin 2Jenkins GitLab Plugin 2Jenkins Zowe zDevOps Plugin 2Jenkins External Workspace Manager Plugin 2Jenkins Credentials Binding Plugin 2Jenkins GitHub Branch Source Plugin 2Jenkins Curseforge Publisher Plugin 2Jenkins MCP Server Plugin 2Jenkins Start Windocks Containers Plugin 2Jenkins ByteGuard Build Actions Plugin 2Jenkins EC2 Fleet Plugin 2Jenkins Git client Plugin 2Jenkins Job Configuration History Plugin 2Jenkins Bitbucket Push and Pull Request Plugin 2Jenkins AWS CodeBuild Plugin 1Jenkins CodeSonar Plugin 1Jenkins Horreum Plugin 1Jenkins Ivy Report Plugin 1Jenkins Priority Sorter Plugin 1Jenkins Sauce OnDemand Plugin 1Jenkins Git Parameter Plugin 1
CVE-2025-64147
Média · 4.3
CWE-311 29/10/2025
Missing Encryption of Sensitive Data em Jenkins Curseforge Publisher
Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2025-64146
Média · 4.3
CWE-311 29/10/2025
Missing Encryption of Sensitive Data em Jenkins Curseforge Publisher
Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
CVE-2025-64145
Média · 4.3
CWE-311 29/10/2025
Missing Encryption of Sensitive Data em Jenkins Byteguard Build Actions
Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2025-64144
Média · 4.3
CWE-311 29/10/2025
Missing Encryption of Sensitive Data em Jenkins Byteguard Build Actions
Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
CVE-2025-64143
Média · 4.3
CWE-311 29/10/2025
Missing Encryption of Sensitive Data em Jenkins Openshift Pipeline
Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
CVE-2025-64142
Média · 4.3
CWE-862 29/10/2025
Missing Authorization em Jenkins Nexus Task Runner
A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2025-64141
Média · 4.3
CWE-352 29/10/2025
Cross-Site Request Forgery (CSRF) em Jenkins Nexus Task Runner
A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2025-64140
Alta · 8.8
CWE-78 29/10/2025
OS Command Injection em Jenkins Azure Cli
Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands.
CVE-2025-64139
Média · 4.3
CWE-862 29/10/2025
Missing Authorization em Jenkins Start Windocks Container
A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2025-64138
Média · 4.3
CWE-352 29/10/2025
Cross-Site Request Forgery (CSRF) em Jenkins Start Windocks Container
A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.
CVE-2025-64137
Média · 4.3
CWE-862 29/10/2025
Missing Authorization em Jenkins Themis
A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
CVE-2025-64136
Média · 4.3
CWE-352 29/10/2025
Cross-Site Request Forgery (CSRF) em Jenkins Themis
A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.
CVE-2025-64135
Média · 5.9
CWE-1188 29/10/2025
Insecure Default Initialization of Resource em Jenkins Eggplant Runner
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime.
CVE-2025-64134
Alta · 7.1
CWE-611 29/10/2025
XML External Entity (XXE) em Jenkins Jdepend
Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2025-64133
Média · 5.4
CWE-352 29/10/2025
Cross-Site Request Forgery (CSRF) em Jenkins Extensible Choice Parameter
A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code.
CVE-2025-64132
Média · 5.4
CWE-862 29/10/2025
Missing Authorization em Jenkins Mcp Server
Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access.
CVE-2025-64131
Alta · 7.5
CWE-294 29/10/2025
Authentication Bypass by Capture-replay em Jenkins Saml
Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, authenticating to Jenkins as that user.
CVE-2024-23897
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-22 24/01/2024
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
CVE-2019-1003030
Crítica · 9.9
KEV Urgente · 78 Exploit público CWE-693 08/03/2019
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
CVE-2019-1003029
Crítica · 9.9
KEV Urgente · 72 Exploit público 08/03/2019
Bypass de Sandbox no Plugin Jenkins Script Security Permite Execução de Código
Existe uma vulnerabilidade de bypass de sandbox no Jenkins Script Security Plugin 1.53 e anteriores, nos arquivos src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java e src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java, que permite que atacantes com permissão Overall/Read executem código arbitrário na JVM do master do Jenkins.