Open Source Vulnerabilities

org.jenkins-ci.plugins:external-monitor-job

External Monitor Job Type Plugin does not require POST requests for an HTTP endpoint

org.jenkins-ci.plugins:git

Lack of authentication mechanism in Jenkins Git Plugin webhook

org.jenkins-ci.plugins:git-client

Jenkins Git client plugin 3.11.0 does not perform SSH host key verification

org.jenkins-ci.plugins:jobConfigHistory

Jenkins Job Configuration History Plugin does not require POST requests for several HTTP endpoints

com.coravy.hudson.plugins.github:github

Jenkins GitHub plugin uses weak webhook signature function

org.jenkins-ci.plugins:git

Lack of authentication mechanism in Jenkins Git Plugin webhook

com.datapipe.jenkins.plugins:hashicorp-vault-plugin

Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests

org.jenkins-ci.plugins:http_request

Jenkins HTTP Request Plugin stores HTTP Request passwords unencrypted

com.compuware.jenkins:compuware-ispw-operations

Agent-to-controller security bypass in Jenkins BMC Compuware ISPW Operations plugin

org.jenkins-ci.plugins:openshift-deployer

CSRF vulnerability in Jenkins OpenShift Deployer Plugin

org.jenkins-ci.plugins:coverity

Jenkins Coverity Plugin vulnerable to cross-site request forgery (CSRF)

com.compuware.jenkins:compuware-zadviser-api

Jenkins Compuware zAdviser API Plugin vulnerable to protection mechanism failure

org.jenkins-ci.plugins:lucene-search

Jenkins Lucene-Search Plugin vulnerable to reflected (XSS) cross-site scripting

org.jenkins-ci.plugins:clif-performance-testing

Arbitrary file write vulnerability in Jenkins CLIF Performance Testing plugin

com.compuware.jenkins:compuware-scm-downloader

Jenkins Compuware Source Code Download is missing authorization

org.jenkins-ci.plugins:repository-connector

Jenkins Repository Connector Plugin allows attackers with Overall/Read permission to enumerate credentials IDs

org.jenkins-ci.plugins:openshift-deployer

Missing permission check in Jenkins OpenShift Deployer Plugin

org.jenkins-ci.plugins:buckminster

Jenkins Buckminster Plugin does not perform a permission check in a method implementing form validation

eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin

Stored XSS vulnerability in Jenkins Maven Metadata Plugin for Jenkins CI server plugin

org.jenkins-ci.plugins:openshift-deployer

CSRF vulnerability in Jenkins OpenShift Deployer Plugin

org.jenkins-ci.plugins:coverity

Missing permission check in Coverity Plugin allows capturing credentials

org.jenkins-ci.plugins:google-cloud-backup

Jenkins Google Cloud Backup Plugin allows attackers with Overall/Read permission to request a manual backup.

com.compuware.jenkins:compuware-ispw-operations

Jenkins Compuware ISPW Operations Plugin does not perform permission checks in several HTTP endpoints

org.jenkins-ci.plugins:repository-connector

Jenkins Repository Connector Plugin does not perform a permission check in a method implementing form validation

org.jenkins-ci.plugins:openstack-heat

CSRF vulnerability in Jenkins openstack-heat Plugin

org.jenkins-ci.plugins:deployer-framework

Jenkins Deployer Framework Plugin vulnerable to Path Traversal

org.jenkins-ci.plugins:openstack-heat

Missing permission checks in Jenkins openstack-heat Plugin

com.compuware.jenkins:compuware-xpediter-code-coverage

Jenkins Compuware Xpediter Code Coverage Plugin Missing Authorization

org.jenkins-ci.plugins:deployer-framework

Jenkins Deployer Framework Plugin does not restrict application path of applications when configuring a deployment

org.jenkins-ci.plugins:files-found-trigger

Jenkins Files Found Trigger Plugin allows attackers to check for existence of attacker-specified file path on Jenkins controller file system

org.jenkins-ci.plugins:openshift-deployer

Missing permission check in Jenkins OpenShift Deployer Plugin

com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter

Stored XSS vulnerability in Jenkins Dynamic Extended Choice Parameter plugin

org.jenkins-ci.plugins:google-cloud-backup

CSRF vulnerability in Jenkins Google Cloud Backup Plugin

org.jenkins-ci.plugins:lucene-search

Lucene-Search Plugin does not perform permission checks in several HTTP endpoints

org.jenkins-ci.plugins:openstack-heat

Jenkins Openstack Heat Plugin does not perform permission checks in methods implementing form validation

org.jenkins-ci.plugins:rpmsign-plugin

Jenkins rpmsign-plugin does not perform a permission check in a method implementing form validation

com.compuware.jenkins:compuware-topaz-utilities

Jenkins Compuware Topaz Utilities Plugin is missing authorization

org.jenkins-ci.plugins:deployer-framework

Jenkins Deployer Framework Plugin allows attackers with Item/Read permission to read deployment logs

org.jenkins-ci.plugins:android-signing

Jenkins Android Signing Plugin allows attackers to check whether attacker-specified file patterns match workspace contents

org.jenkins-ci.plugins:rhnpush-plugin

Jenkins rhnpush-plugin does not perform a permission check in a method implementing form validation

org.jenkins-ci.plugins:coverity

Jenkins Coverity Plugin allows attackers with Overall/Read permission to enumerate credentials IDs

lcms

Segv on unknown address in cmsNamedColorInfo

ghostscript

Stack-use-after-return in rc_free_text_enum

chromium, chromium, chromium