CVE-2019-10349

A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.

• CWE-79

• http://packetstormsecurity.com/files/153610/Jenkins-Dependency-Graph-View-0.13-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2019/07/11/4Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/109156Broken Link, Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1177Vendor Advisory
• http://packetstormsecurity.com/files/153610/Jenkins-Dependency-Graph-View-0.13-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2019/07/11/4Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/109156Broken Link, Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1177Vendor Advisory

Published

Jul 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10343Jenkins Configuration as Code Plugin 1.24 and earlier did no…3.3
• CVE-2019-10344Missing permission checks in Jenkins Configuration as Code P…4.3
• CVE-2019-10345Jenkins Configuration as Code Plugin 1.20 and earlier did no…5.5
• CVE-2019-10346A reflected cross site scripting vulnerability in Jenkins Em…6.1
• CVE-2019-10347Jenkins Mashup Portlets Plugin stored credentials unencrypte…8.8
• CVE-2019-10348Jenkins Gogs Plugin stored credentials unencrypted in job co…8.8
• CVE-2019-1035A remote code execution vulnerability exists in Microsoft Wo…7.8
• CVE-2019-10350Jenkins Port Allocator Plugin stores credentials unencrypted…8.8
• CVE-2019-10351Jenkins Caliper CI Plugin stores credentials unencrypted in …8.8
• CVE-2019-10352A path traversal vulnerability in Jenkins 2.185 and earlier,…
• CVE-2019-10353CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and ea…
• CVE-2019-10354A vulnerability in the Stapler web framework used in Jenkins…4.3