GCVE - cpe:2.3:a:jenkins:websphere_deployer:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:websphere_deployer:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Websphere Deployer (`2150706a-8c29-58fc-81ef-2f7b4489585e`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-2108`	vulnerable	2026-06-08 05:24:58.904473	Details available Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions. Published: 2020-01-29T15:15:31.000Z Updated: 2024-08-04T07:01:39.769Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1719 http://www.openwall.com/lists/oss-security/2020/01/29/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-16561`	vulnerable	2026-06-08 05:13:08.579823	Details available Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM. Published: 2019-12-17T14:40:50.000Z Updated: 2024-08-05T01:17:41.047Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1581 http://www.openwall.com/lists/oss-security/2019/12/17/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-16560`	vulnerable	2026-06-08 05:13:08.579362	Details available A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system. Published: 2019-12-17T14:40:50.000Z Updated: 2024-08-05T01:17:41.041Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371 http://www.openwall.com/lists/oss-security/2019/12/17/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-16559`	vulnerable	2026-06-08 05:13:08.578920	Details available A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system. Published: 2019-12-17T14:40:49.000Z Updated: 2024-08-05T01:17:40.812Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371 http://www.openwall.com/lists/oss-security/2019/12/17/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-1003056`	vulnerable	2026-06-08 05:12:21.476815	Details available Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Published: 2019-04-04T15:38:48.000Z Updated: 2024-08-05T03:07:17.883Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/107790 http://www.openwall.com/lists/oss-security/2019/04/12/2 https://jenkins.io/security/advisory/2019-04-03/#SECURITY-956	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.