Most recent entries from all

cnvd-2016-03162

EUVD-2026-83784

fkie_cve-2016-3727

The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors.

GHSA-6cr3-cm5h-8q96 — Jenkins Exposes Sensitive Information via API URL

Affected: Maven: org.jenkins-ci.main:jenkins-core

gsd-2016-3727

RHSA-2016:1206 — Red Hat Security Advisory: jenkins security update

jenkins: Arbitrary build parameters are passed to build scripts as environment variables (SECURITY-170) jenkins: Malicious users with multiple user accounts can prevent other users from logging in (SECURITY-243) jenkins: Information on installed plugins exposed via API (SECURITY-250) jenkins: Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration (SECURITY-266) jenkins: Regular users can trigger download of update site metadata (SECURITY-273) jenkins: Open redirect to scheme-relative URLs (SECURITY-276) jenkins: Granting the permission to read node configurations allows access to overall system configuration (SECURITY-281)