# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
1 |
CVE-2022-34818 |
862 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
None |
Partial |
None |
Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs. |
2 |
CVE-2022-34817 |
352 |
|
CSRF |
2022-06-30 |
2022-07-08 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs. |
3 |
CVE-2022-34816 |
256 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
4 |
CVE-2022-34815 |
352 |
|
CSRF |
2022-06-30 |
2022-07-08 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, thereby renaming or deleting jobs. |
5 |
CVE-2022-34814 |
863 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending requests. |
6 |
CVE-2022-34813 |
862 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
None |
Partial |
None |
A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XPath expressions. |
7 |
CVE-2022-34812 |
352 |
|
CSRF |
2022-06-30 |
2022-07-08 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath expressions. |
8 |
CVE-2022-34811 |
862 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to access the XPath Configuration Viewer page. |
9 |
CVE-2022-34810 |
862 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |
10 |
CVE-2022-34809 |
256 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. |
11 |
CVE-2022-34808 |
522 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
12 |
CVE-2022-34807 |
256 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. |
13 |
CVE-2022-34806 |
256 |
|
|
2022-06-30 |
2022-07-11 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. |
14 |
CVE-2022-34805 |
256 |
|
|
2022-06-30 |
2022-07-11 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. |
15 |
CVE-2022-34804 |
318 |
|
|
2022-06-30 |
2022-07-11 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure. |
16 |
CVE-2022-34803 |
256 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission (config.xml), or access to the Jenkins controller file system. |
17 |
CVE-2022-34802 |
256 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
18 |
CVE-2022-34801 |
318 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure. |
19 |
CVE-2022-34800 |
256 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
20 |
CVE-2022-34799 |
256 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. |
21 |
CVE-2022-34797 |
352 |
|
CSRF |
2022-06-30 |
2022-07-08 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials. |
22 |
CVE-2022-34796 |
862 |
|
|
2022-06-30 |
2022-10-17 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |
23 |
CVE-2022-34794 |
862 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
None |
Partial |
None |
Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML. |
24 |
CVE-2022-34789 |
352 |
|
CSRF |
2022-06-30 |
2022-07-08 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous matrix builds. |
25 |
CVE-2022-34785 |
862 |
|
+Info |
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them. |
26 |
CVE-2022-34782 |
863 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests. |
27 |
CVE-2022-34781 |
862 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
28 |
CVE-2022-34780 |
352 |
|
CSRF |
2022-06-30 |
2022-07-08 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
29 |
CVE-2022-34779 |
862 |
|
|
2022-06-30 |
2022-07-08 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |
30 |
CVE-2022-34213 |
522 |
|
|
2022-06-23 |
2022-06-30 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
31 |
CVE-2022-34211 |
352 |
|
CSRF |
2022-06-23 |
2022-06-29 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an attacker-specified URL. |
32 |
CVE-2022-34210 |
862 |
|
|
2022-06-23 |
2022-06-29 |
4.0 |
None |
Remote |
Low |
??? |
None |
Partial |
None |
A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
33 |
CVE-2022-34209 |
352 |
|
CSRF |
2022-06-23 |
2022-06-29 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A cross-site request forgery (CSRF) vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-specified URL. |
34 |
CVE-2022-34208 |
862 |
|
|
2022-06-23 |
2022-06-30 |
4.0 |
None |
Remote |
Low |
??? |
None |
Partial |
None |
A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
35 |
CVE-2022-34207 |
352 |
|
CSRF |
2022-06-23 |
2022-06-29 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A cross-site request forgery (CSRF) vulnerability in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers to connect to an attacker-specified URL. |
36 |
CVE-2022-34206 |
862 |
|
|
2022-06-23 |
2022-06-30 |
4.0 |
None |
Remote |
Low |
??? |
None |
Partial |
None |
A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL. |
37 |
CVE-2022-34205 |
352 |
|
CSRF |
2022-06-23 |
2022-06-29 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an attacker-specified URL. |
38 |
CVE-2022-34204 |
862 |
|
|
2022-06-23 |
2022-06-30 |
4.0 |
None |
Remote |
Low |
??? |
None |
Partial |
None |
A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server. |
39 |
CVE-2022-34202 |
256 |
|
|
2022-06-23 |
2022-06-29 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
40 |
CVE-2022-34201 |
862 |
|
|
2022-06-23 |
2022-06-29 |
4.0 |
None |
Remote |
Low |
??? |
None |
Partial |
None |
A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
41 |
CVE-2022-34199 |
256 |
|
|
2022-06-23 |
2022-06-29 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. |
42 |
CVE-2022-34182 |
79 |
|
XSS |
2022-06-23 |
2022-06-29 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerability. |
43 |
CVE-2022-34178 |
79 |
|
XSS |
2022-06-23 |
2022-06-29 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting (XSS) vulnerability. |
44 |
CVE-2022-34173 |
79 |
|
XSS |
2022-06-23 |
2022-11-05 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
45 |
CVE-2022-34172 |
79 |
|
XSS |
2022-06-23 |
2022-11-05 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability. |
46 |
CVE-2022-34171 |
79 |
|
XSS |
2022-06-23 |
2022-11-05 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability. |
47 |
CVE-2022-34170 |
79 |
|
XSS |
2022-06-23 |
2022-11-05 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
48 |
CVE-2022-30959 |
862 |
|
|
2022-05-17 |
2022-05-25 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
49 |
CVE-2022-30957 |
862 |
|
|
2022-05-17 |
2022-05-26 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |
50 |
CVE-2022-30955 |
862 |
|
|
2022-05-17 |
2022-05-26 |
4.0 |
None |
Remote |
Low |
??? |
Partial |
None |
None |
Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |