Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1749 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-2235 1 Jenkins 1 Pipeline Maven Integration 2024-11-21 6.5 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.
CVE-2020-2234 1 Jenkins 1 Pipeline Maven Integration 2024-11-21 6.5 Medium
A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.
CVE-2020-2233 1 Jenkins 1 Pipeline Maven Integration 2024-11-21 6.5 Medium
A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVE-2020-2232 1 Jenkins 1 Email Extension 2024-11-21 7.5 High
Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potentially resulting in its exposure.
CVE-2020-2231 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 5.4 Medium
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.
CVE-2020-2230 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 5.4 Medium
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.
CVE-2020-2229 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 5.4 Medium
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
CVE-2020-2228 1 Jenkins 1 Gitlab Authentication 2024-11-21 8.8 High
Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability.
CVE-2020-2227 1 Jenkins 1 Deployer Framework 2024-11-21 5.4 Medium
Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2226 2 Jenkins, Redhat 2 Matrix Authorization Strategy, Openshift 2024-11-21 5.4 Medium
Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2225 2 Jenkins, Redhat 2 Matrix Project, Openshift 2024-11-21 5.4 Medium
Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2224 2 Jenkins, Redhat 2 Matrix Project, Openshift 2024-11-21 5.4 Medium
Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2223 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 5.4 Medium
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2222 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 5.4 Medium
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2221 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 5.4 Medium
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2220 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 5.4 Medium
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2219 1 Jenkins 1 Link Column 2024-11-21 5.4 Medium
Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2216 1 Jenkins 1 Zephyr For Jira Test Management 2024-11-21 4.3 Medium
A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified username and password.
CVE-2020-2215 1 Jenkins 1 Zephyr For Jira Test Management 2024-11-21 4.3 Medium
A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified username and password.
CVE-2020-2214 1 Jenkins 1 Zap Pipeline 2024-11-21 5.4 Medium
Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.