Threat database

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

EPSS 0.6%VulnerabilityJenkins projectGermanyFrance+6

A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials.

EPSS 1.0%VulnerabilityJenkins projectGermanyFrance+6

A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials.

EPSS 0.5%VulnerabilityJenkins projectGermanyFrance+5

Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

EPSS 0.9%VulnerabilityJenkins projectGermanyFrance+6

Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.

EPSS 0.7%VulnerabilityJenkins projectGermanyFrance+6

Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.

EPSS 1.1%VulnerabilityJenkins projectGermanyFrance+6

CVE-2019-1003029 is a vulnerability in the Jenkins Script Security Plugin that allows attackers to bypass the sandbox protection mechanism. This flaw enables malicious scripts to execute outside the intended restricted environment, potentially leading to unauthorized code execution. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

The Jenkins Matrix Project plugin contains a vulnerability that allows users to escape the sandbox, enabling remote code execution. This vulnerability has been exploited in the wild, posing a high risk to affected Jenkins installations.

CVE-2018-1000861 is a high-severity code execution vulnerability in the Stapler web framework used by Jenkins. It involves deserialization of untrusted data, which can lead to remote code execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the input data.