CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Jenkins : Security Vulnerabilities (Execute Code)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2023-27899 863 Exec Code 2023-03-10 2023-03-16
0.0
 None ??? ??? ??? ??? ??? ???
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a plugin for installation, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used, potentially resulting in arbitrary code execution.
2 CVE-2023-25765 693 Exec Code Bypass 2023-02-15 2023-02-23
0.0
 None ??? ??? ??? ??? ??? ???
In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
3 CVE-2023-24422 78 Exec Code Bypass 2023-01-26 2023-02-04
0.0
 None ??? ??? ??? ??? ??? ???
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
4 CVE-2022-43406 693 Exec Code Bypass 2022-10-19 2022-10-24
0.0
 None ??? ??? ??? ??? ??? ???
A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
5 CVE-2022-43405 Exec Code Bypass 2022-10-19 2022-10-21
0.0
 None ??? ??? ??? ??? ??? ???
A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
6 CVE-2022-43404 693 Exec Code Bypass 2022-10-19 2022-10-21
0.0
 None ??? ??? ??? ??? ??? ???
A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
7 CVE-2022-43403 693 Exec Code Bypass 2022-10-19 2023-03-01
0.0
 None ??? ??? ??? ??? ??? ???
A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
8 CVE-2022-43402 693 Exec Code Bypass 2022-10-19 2023-01-30
0.0
 None ??? ??? ??? ??? ??? ???
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
9 CVE-2022-43401 693 Exec Code Bypass 2022-10-19 2022-10-31
0.0
 None ??? ??? ??? ??? ??? ???
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
10 CVE-2022-41237 502 Exec Code 2022-09-21 2022-09-22
0.0
 None ??? ??? ??? ??? ??? ???
Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
11 CVE-2022-30969 352 Exec Code CSRF 2022-05-17 2022-05-25
6.8
 None Remote Medium Not required Partial Partial Partial
A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator.
12 CVE-2022-30950 120 Exec Code Overflow 2022-05-17 2022-05-26
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflow vulnerability that may allow users able to connect to a named pipe to execute commands on the Windows agent machine.
13 CVE-2022-25183 Exec Code 2022-02-15 2022-02-23
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library names if a global Pipeline library configured to use caching already exists.
14 CVE-2022-25182 Exec Code Bypass 2022-02-15 2022-02-23
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller JVM using specially crafted library names if a global Pipeline library is already configured.
15 CVE-2022-25181 Exec Code Bypass 2022-02-15 2022-02-23
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM contents, if a global Pipeline library already exists.
16 CVE-2022-20617 78 Exec Code 2022-01-12 2022-01-18
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.
17 CVE-2021-21696 693 Exec Code 2021-11-04 2021-11-08
7.5
 None Remote Low Not required Partial Partial Partial
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library with a modified variant. This results in unsandboxed code execution in the Jenkins controller process.
18 CVE-2021-21677 502 Exec Code 2021-08-31 2021-09-08
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulting in a remote code execution vulnerability.
19 CVE-2021-21646 693 Exec Code 2021-04-21 2021-04-26
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
20 CVE-2020-2280 352 Exec Code CSRF 2020-09-23 2020-09-28
6.8
 None Remote Medium Not required Partial Partial Partial
A cross-site request forgery (CSRF) vulnerability in Jenkins Warnings Plugin 5.0.1 and earlier allows attackers to execute arbitrary code.
21 CVE-2020-2279 Exec Code Bypass 2020-09-23 2020-09-28
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide crafted return values or script binding content that can result in arbitrary code execution on the Jenkins controller JVM.
22 CVE-2020-2276 78 Exec Code 2020-09-16 2020-09-18
9.0
 None Remote Low ??? Complete Complete Complete
Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins controller as the OS user that the Jenkins process is running as.
23 CVE-2020-2261 78 Exec Code 2020-09-16 2020-09-18
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller
24 CVE-2020-2211 502 Exec Code 2020-07-02 2020-07-06
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
25 CVE-2020-2189 502 Exec Code 2020-05-06 2020-05-07
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
26 CVE-2020-2180 502 Exec Code 2020-04-16 2020-04-28
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
27 CVE-2020-2179 502 Exec Code 2020-04-16 2020-04-27
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
28 CVE-2020-2168 20 Exec Code 2020-03-25 2020-03-30
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
29 CVE-2020-2167 20 Exec Code 2020-03-25 2020-03-30
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
30 CVE-2020-2166 20 Exec Code 2020-03-25 2020-03-30
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
31 CVE-2020-2159 78 Exec Code 2020-03-09 2022-10-07
9.0
 None Remote Low ??? Complete Complete Complete
Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins.
32 CVE-2020-2158 502 Exec Code 2020-03-09 2020-03-09
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
33 CVE-2020-2123 502 Exec Code 2020-02-12 2020-02-14
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
34 CVE-2020-2121 Exec Code 2020-02-12 2020-02-14
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
35 CVE-2020-2098 352 Exec Code CSRF 2020-01-15 2020-01-22
9.3
 None Remote Medium Not required Complete Complete Complete
A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account running Jenkins.
36 CVE-2020-2097 863 Exec Code 2020-01-15 2020-01-23
6.5
 None Remote Low ??? Partial Partial Partial
Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins.
37 CVE-2019-1003034 Exec Code Bypass 2019-03-08 2020-09-30
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/SandboxDslScriptLoader.groovy that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM.
38 CVE-2019-1003033 Exec Code Bypass 2019-03-08 2020-09-30
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
39 CVE-2019-1003032 Exec Code Bypass 2019-03-08 2020-09-30
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
40 CVE-2019-1003031 Exec Code Bypass 2019-03-08 2020-09-30
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
41 CVE-2019-1003030 693 Exec Code Bypass 2019-03-08 2020-10-19
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
42 CVE-2019-1003029 Exec Code Bypass 2019-03-08 2022-06-13
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
43 CVE-2019-1003024 Exec Code Bypass 2019-02-20 2020-09-29
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
44 CVE-2019-1003008 352 Exec Code CSRF 2019-02-06 2019-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.
45 CVE-2019-1003007 352 Exec Code CSRF 2019-02-06 2019-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.
46 CVE-2019-1003006 862 Exec Code Bypass 2019-02-06 2020-09-29
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
47 CVE-2019-1003005 Exec Code Bypass 2019-02-06 2022-06-13
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
48 CVE-2019-1003002 Exec Code Bypass 2019-01-22 2020-09-29
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
49 CVE-2019-1003001 Exec Code Bypass 2019-01-22 2020-09-29
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
50 CVE-2019-1003000 Exec Code Bypass 2019-01-22 2020-09-29
6.5
 None Remote Low ??? Partial Partial Partial
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
Total number of vulnerabilities : 83   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.