Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 259
Reset filtersJenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations
Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL
Jenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL
Jenkins exposes other users' timezone and view names to users with Overall/Read permission
Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"
Jenkins: Stored XSS vulnerability in node offline cause description
Jenkins has a link following vulnerability allows arbitrary file creation
Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
Jenkins has a build information disclosure vulnerability through Run Parameter
Jenkins has a stored XSS vulnerability in node offline cause description
Jenkins is missing a permission check on password fields
Jenkins's build authorization token is stored and displayed in plain text
Jenkins's build authorization token is stored and displayed in plain text
Jenkins has a Denial of service vulnerability in HTTP-based CLI
Jenkins has a CSRF vulnerability on the login form
Jenkins has a log message injection vulnerability
Jenkins has a missing permission check, allowing users to obtain agent names
Jenkins is missing a permission check in the authenticated users' profile menu
Jenkins Missing Permission Check
Jenkins Missing Permission Check
Jenkins cross-site request forgery (CSRF) vulnerability
Jenkins Open Redirect vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.