Login Request a demo
RU
Product
Rundeck
by Jenkins · last CVE Sep 21, 2022
7
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 0High 2Medium 5Low 0
Severity
All severities7Critical0High2Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Rundeck to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-41234
8.8
1%
Sep 21
Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trigger jobs that are…
Affected: through 3.6.11
CVE-2020-2144
7.1
1%
Mar 9
Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks
Affected: through 3.6.6
CVE-2019-16556
6.5
1%
Dec 17
Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed…
Affected: through 3.6.5
CVE-2022-30956
5.4
73%
May 17
Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable…
Affected: through 3.6.10
CVE-2022-41233
4.3
1%
Sep 21
Jenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers with Item/Read permission to obtain…
Affected: through 3.6.11
CVE-2019-10455
4.3
1%
Oct 16
A missing permission check in Jenkins Rundeck Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials
Affected: through 3.6.5
CVE-2019-10454
4.3
1%
Oct 16
A cross-site request forgery vulnerability in Jenkins Rundeck Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials
Affected: through 3.6.5
Showing 7