CVE-2016-3726

jenkins: Open redirect to scheme-relative URLs (SECURITY-276)

Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to "scheme-relative" URLs.

CVSS 3.0 · 7.4 High EPSS 2.3% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-3725

jenkins: Regular users can trigger download of update site metadata (SECURITY-273)

Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missing permissions check. NOTE: this issue can be combined with DNS cache poisoning to cause a denial of service (service disruption).

CVSS 3.0 · 4.3 Medium EPSS 2.4% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-3724

jenkins: Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration (SECURITY-266)

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job configuration.

CVSS 3.0 · 6.5 Medium EPSS 2.2% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-3723

jenkins: Information on installed plugins exposed via API (SECURITY-250)

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.

CVSS 3.0 · 4.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-3722

jenkins: Malicious users with multiple user accounts can prevent other users from logging in (SECURITY-243)

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name."

CVSS 3.0 · 4.3 Medium EPSS 2.3% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-3721

jenkins: Arbitrary build parameters are passed to build scripts as environment variables (SECURITY-170)

Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables.

CVSS 3.1 · 4.3 Medium EPSS 2.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-0792

jenkins: Remote code execution through remote API (SECURITY-247)

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

CVSS 3.0 · 8.8 High EPSS 83.3% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-0791

jenkins: Non-constant time comparison of CSRF crumbs (SECURITY-245)

Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.

CVSS 3.0 · 9.8 Critical EPSS 2.7% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-0790

jenkins: Non-constant time comparison of API token (SECURITY-241)

Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.

CVSS 3.0 · 5.3 Medium EPSS 2.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-0789

jenkins: HTTP response splitting vulnerability (SECURITY-238)

CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

CVSS 3.0 · 6.1 Medium EPSS 1.8% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-0788

jenkins: Remote code execution vulnerability in remoting module (SECURITY-232)

The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.

CVSS 3.0 · 9.8 Critical EPSS 11.8% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2015-8103

jenkins: Remote code execution vulnerability due to unsafe deserialization in Jenkins remoting (SECURITY-218)

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".

CVSS 3.1 · 9.8 Critical EPSS 91.9% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift Openshift Container Platform

CVE-2015-7539

jenkins: Jenkins plugin manager vulnerable to MITM attacks (SECURITY-234)

The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin.

CVSS 3.0 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2015-7538

jenkins: CSRF protection ineffective (SECURITY-233)

Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 2.2% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2015-7537

jenkins: CSRF vulnerability in some administrative actions (SECURITY-225)

Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.

CVSS 3.0 · 8.8 High EPSS 2.4% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2015-7536

jenkins: stored XSS vulnerability through workspace files and archived artifacts (SECURITY-95)

Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.

CVSS 3.0 · 5.4 Medium EPSS 1.3% KEV · Not listed

Vendors

Jenkins

Products

Jenkins

CVE-2015-5326

jenkins: Stored XSS vulnerability in slave offline status message (SECURITY-214)

Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2015-5325

jenkins: JNLP slaves not subject to slave-to-master access control (SECURITY-206)

Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665.

CVSS 2.0 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2015-5324

jenkins: Queue API did show items not visible to the current user (SECURITY-186)

Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.

CVSS 2.0 · 5.0 Medium EPSS 2.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2015-5323

jenkins: API tokens of other users available to admins (SECURITY-200)

Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.

CVSS 2.0 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift