Read the docs

Jenkins

Records1915All Threatist records
Exploited (KEV)7In CISA KEV
CVSS critical79CVSS 9.0–10.0
CVSS high524CVSS 7.0–8.9

Exploited now

Jenkins records in CISA KEV
TI-2017-14573 Jenkins Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2025-10-02TI-2024-15885 Jenkins Command Line Interface (CLI) Path Traversal Vulnerability Priority CRITICAL 100KEV 2024-08-19TI-2023-23979 HTTP/2 Rapid Reset Attack Vulnerability Priority CRITICAL 90KEV 2023-10-10TI-2015-04472 Jenkins User Interface (UI) Information Disclosure Vulnerability Priority CRITICAL 90KEV 2023-05-12TI-2019-15874 Jenkins Script Security Plugin Sandbox Bypass Vulnerability Priority CRITICAL 100KEV 2022-04-25TI-2019-15875 Jenkins Matrix Project Plugin Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Jenkins 294 records CRITICAL Script Security 45 records CRITICAL Pipeline 40 records CRITICAL Active Directory 12 records MEDIUM Blue Ocean 11 records MEDIUM Email Extension 11 records MEDIUM Git 11 records MEDIUM Build Failure Analyzer 9 records MEDIUM

Records

8 records in Ns-nd Integration Performance Publisher · all components

TI-2022-19738 CVE-2022-41228 · GHSA-j2mj-g8jp-gjfm

Missing authorization in Jenkins NS-ND Integration Performance Publisher Plugin

Priority MEDIUM 42

A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-speci…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00978 Published 2022-09-21 Fixed in 4.8.0.130 CWE-862
TI-2022-19737 CVE-2022-41227 · GHSA-jjch-7g85-4m72

Cross-site request forgery in Jenkins NS-ND Integration Performance Publisher Plugin

Priority MEDIUM 41

A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified cr…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00543 Published 2022-09-21 Fixed in 4.8.0.130 CWE-352
TI-2022-22358 CVE-2022-45392 · GHSA-x2w2-5552-fjv6

Insufficiently protected credentials in Jenkins NS-ND Integration Performance Publisher…

Priority LOW 30

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permiss…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00717 Published 2022-11-15 Fixed in 4.8.0.146 CWE-522
TI-2022-19739 CVE-2022-41229 · GHSA-fq2h-r2h9-pj8r

Cross-site scripting in Jenkins NS-ND Integration Performance Publisher Plugin

Priority LOW 25

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step, resulting in a stored cross-site scripting (XSS) vulner…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00621 Published 2022-09-21 Fixed in 4.8.0.147 CWE-79
TI-2022-15106 CVE-2022-34191 · GHSA-pv38-mqpp-v72h

Cross-site scripting in Jenkins NS-ND Integration Performance Publisher Plugin

Priority LOW 25

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerabil…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00656 Published 2022-06-22 Fixed in 4.8.0.129 CWE-79
Open these records in search →