Known vulnerabilities in Jenkins
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2020-2220 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page,… | Not rated | Jul 15, 2020 |
| CVE-2020-2163 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers,… | Not rated | Mar 25, 2020 |
| CVE-2020-2162 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as… | Not rated | Mar 25, 2020 |
| CVE-2020-2161 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form… | Not rated | Mar 25, 2020 |
| CVE-2020-2160 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows… | Not rated | Mar 25, 2020 |
| CVE-2012-0785 | Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by… | Not rated | Feb 24, 2020 |
| CVE-2020-2105 | REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks | Not rated | Jan 29, 2020 |
| CVE-2020-2104 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage… | Not rated | Jan 29, 2020 |
| CVE-2020-2103 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI… | Not rated | Jan 29, 2020 |
| CVE-2020-2102 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC | Not rated | Jan 29, 2020 |
| CVE-2020-2101 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating… | Not rated | Jan 29, 2020 |
| CVE-2020-2100 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service… | Not rated | Jan 29, 2020 |
| CVE-2020-2099 | Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP… | Not rated | Jan 29, 2020 |
| CVE-2019-10406 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global… | Not rated | Sep 25, 2019 |
| CVE-2019-10405 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/… | Not rated | Sep 25, 2019 |
| CVE-2019-10404 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips,… | Not rated | Sep 25, 2019 |
| CVE-2019-10403 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions,… | Not rated | Sep 25, 2019 |
| CVE-2019-10402 | In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as… | Not rated | Sep 25, 2019 |
| CVE-2019-10401 | In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as… | Not rated | Sep 25, 2019 |
| CVE-2019-10384 | Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session… | Not rated | Aug 28, 2019 |
| CVE-2019-10383 | A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with… | Not rated | Aug 28, 2019 |
| CVE-2019-10354 | A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed… | Not rated | Jul 17, 2019 |
| CVE-2019-10353 | CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to… | Not rated | Jul 17, 2019 |
| CVE-2019-10352 | A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in… | Not rated | Jul 17, 2019 |
| CVE-2019-1003050 | The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and… | Not rated | Apr 10, 2019 |
Other Jenkins project products
Jenkins Script Security Plugin 39
Jenkins Active Directory Plugin 11
Jenkins Pipeline: Groovy Plugin 11
Jenkins Email Extension Plugin 9
Jenkins OpenId Connect Authentication Plugin 8
Jenkins Pipeline: Shared Groovy Libraries Plugin 8
Jenkins Build Failure Analyzer Plugin 8
Jenkins NS-ND Integration Performance Publisher Plugin 8
Jenkins GitLab Plugin 8
Jenkins Job Configuration History Plugin 8
Jenkins OpenShift Deployer Plugin 7
Jenkins Amazon EC2 Plugin 7