jenkins 2.583 vulnerabilities
jenkins 2.583 has 7 known vulnerabilities (2 high). Each one is ranked by real-world exploitation and severity, with the version that fixes it where one is known. Free, no account.
Cross-referencing the vulnerability databases…
jenkins 2.583
Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin, allowing attackers with Item/Create or Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM.
An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins.
Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bearer token.
Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers to have Jenkins connect to an attacker-specified URL using an attacker-specified username, API key, and service key.
Discovery: OSV.dev, NVD and Red Hat (MITRE-refined). Prioritisation: CISA KEV & EPSS. Findings are best-effort from public sources and are not a substitute for vendor advisories.
Not sure what to type? Start from the product
The software directory has a page for 1000 widely used products, from operating systems and firewalls to the npm and Python packages inside your applications, each with the versions already checked and the advisories they turned up.
Scanning a whole estate?
Our Vulnerability Reporter service inventories your software and reports continuously.