Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,074
Reset filtersJenkins Kubernetes Plugin does not properly mask credentials
Jenkins Report Portal Plugin configuration form does not mask tokens
Jenkins Lucene-Search Plugin vulnerable to Cross-Site Request Forgery
Jenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencrypted
Jenkins WSO2 Oauth Plugin does not mask the WSO2 Oauth client secret on the global configuration form
Jenkins WSO2 Oauth Plugin stores WSO2 Oauth client secret unencrypted in global config.xml file on Jenkins controller
Jenkins Report Portal Plugin missing permissions check
Jenkins Report Portal Plugin Cross-Site Request Forgery vulnerability
Jenkins Report Portal Plugin allows users with Item/Extended Read permission to view tokens on Jenkins controller
Jenkins Fogbugz Plugin has missing permissions check
Jenkins Assembla merge request builder Plugin missing authentication to access endpoint
Jenkins Quay.io trigger Plugin Cross-site Scripting vulnerability
Lack of authentication mechanism in Jenkins TurboScript Plugin webhook
Jenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencrypted
Apache Linkis JDBC EngineConn has deserialization vulnerability
Apache Linkis DatasourceManager module has deserialization vulnerability
XXL-JOB vulnerable to Cross-site Scripting
Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter
Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments
Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames
MyBatis-Plus vulnerable to SQL injection via TenantPlugin
Ming-Soft MCMS vulnerable to SQL injection
Apache James server's JMX management service vulnerable to privilege escalation by local user
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.