İçeriğe atla
Noroxi

Jenkins kayıtları

jenkins üreticisine ait 1.824 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
7 · %0,4
Silahlaştırılmış
14 · %0,8
Pre-auth RCE
17
Düzeltme kaydı olan
%67,7
Yayından KEV’e ortanca
1144 gün

Yıllara göre kayıt

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

1.824 kayıt
  • CVE-2024-23897
    99Hemen

    Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character follo

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    jenkins · jenkins24 Oca 2024

  • CVE-2017-1000353
    99Hemen

    Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    jenkins · jenkins29 Oca 2018

  • CVE-2018-1000861
    98Hemen

    A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/cor

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    jenkins · jenkins10 Ara 2018

  • CVE-2019-1003030
    98Hemen

    A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/wo

    KritikCVSS 9,9KEVSilahlaştırılmışEPSS %97

    jenkins · pipeline\8 Mar 2019

  • CVE-2019-1003029
    91Hemen

    A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecuri

    KritikCVSS 9,9KEVSilahlaştırılmışEPSS %74

    jenkins · script security8 Mar 2019

  • CVE-2023-44487
    90Hemen

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %99

    siemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware10 Eki 2023

  • CVE-2016-9299
    68Bu hafta

    The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized

    KritikCVSS 9,8SilahlaştırılmışEPSS %96

    jenkins · jenkins12 Oca 2017

  • CVE-2015-8103
    67Bu hafta

    The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted ser

    KritikCVSS 9,8SilahlaştırılmışEPSS %91

    jenkins · jenkins25 Kas 2015

  • CVE-2015-5317
    67Bu hafta

    The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name in

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %23

    jenkins · jenkins25 Kas 2015

  • CVE-2019-1003000
    65Bu hafta

    A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandb

    YüksekCVSS 8,8SilahlaştırılmışEPSS %98

    jenkins · script security22 Oca 2019

  • CVE-2018-1000600
    62Bu hafta

    A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java t

    YüksekCVSS 8,8Kavram kanıtıEPSS %90

    jenkins · github26 Haz 2018

  • CVE-2019-1003001
    61Bu hafta

    A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlo

    YüksekCVSS 8,8SilahlaştırılmışEPSS %86

    jenkins · pipeline\22 Oca 2019

  • CVE-2016-0792
    60Bu hafta

    Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code

    YüksekCVSS 8,8SilahlaştırılmışEPSS %83

    jenkins · jenkins7 Nis 2016

  • CVE-2019-1003002
    59Planlayın

    A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jen

    YüksekCVSS 8,8SilahlaştırılmışEPSS %81

    jenkins · pipeline\22 Oca 2019

  • CVE-2018-1999002
    56Planlayın

    A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stap

    YüksekCVSS 7,5Kavram kanıtıEPSS %86

    jenkins · jenkins23 Tem 2018

  • CVE-2024-54003
    56Planlayın

    Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability

    YüksekCVSS 8,0İstismar yokEPSS %80

    jenkins · simple queue27 Kas 2024

  • CVE-2024-23898
    55Planlayın

    Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests ma

    YüksekCVSS 8,8Kavram kanıtıEPSS %67

    jenkins · jenkins24 Oca 2024

  • CVE-2024-34144
    54Planlayın

    A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows

    KritikCVSS 9,8Kavram kanıtıEPSS %48

    jenkins · script security2 May 2024

  • CVE-2023-32986
    53Planlayın

    Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File

    YüksekCVSS 8,8İstismar yokEPSS %60

    jenkins · file parameters16 May 2023

  • CVE-2020-2096
    52Planlayın

    Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerabi

    OrtaCVSS 6,1Kavram kanıtıEPSS %93

    jenkins · gitlab hook15 Oca 2020

  • CVE-2021-21659
    52Planlayın

    Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    YüksekCVSS 8,1İstismar yokEPSS %66

    jenkins · urltrigger25 May 2021

  • CVE-2026-53435
    51Planlayın

    In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in J

    YüksekCVSS 8,8Kavram kanıtıEPSS %53

    jenkins · jenkins10 Haz 2026

  • CVE-2021-21699
    48Planlayın

    Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters,

    OrtaCVSS 5,4İstismar yokEPSS %88

    jenkins · active choices12 Kas 2021

  • CVE-2020-2140
    47Planlayın

    Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a refl

    OrtaCVSS 6,1Kavram kanıtıEPSS %75

    jenkins · audit trail9 Mar 2020

  • CVE-2021-21669
    47Planlayın

    Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    KritikCVSS 9,8İstismar yokEPSS %25

    jenkins · generic webhook trigger18 Haz 2021