Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/72860?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/72860?format=api", "purl": "pkg:maven/org.jenkins-ci.main/jenkins-core@2.541", "type": "maven", "namespace": "org.jenkins-ci.main", "name": "jenkins-core", "version": "2.541", "qualifiers": {}, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": "2.541.2", "latest_non_vulnerable_version": "2.551", "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49388?format=api", "vulnerability_id": "VCID-2knp-8apg-puaj", "summary": "Jenkins's build authorization token is stored and displayed in plain text\nJenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.", "references": [ { "reference_url": "https://github.com/jenkinsci/jenkins", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/jenkinsci/jenkins" }, { "reference_url": "https://github.com/jenkinsci/jenkins/commit/4710d65339251aaf1d1599f19545db99be24d981", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/jenkinsci/jenkins/commit/4710d65339251aaf1d1599f19545db99be24d981" }, { "reference_url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67638", "reference_id": "CVE-2025-67638", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67638" }, { "reference_url": "https://github.com/advisories/GHSA-hxjg-2jvf-h3rx", "reference_id": "GHSA-hxjg-2jvf-h3rx", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-hxjg-2jvf-h3rx" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/72861?format=api", "purl": "pkg:maven/org.jenkins-ci.main/jenkins-core@2.528.3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.528.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/72860?format=api", "purl": "pkg:maven/org.jenkins-ci.main/jenkins-core@2.541", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.541" } ], "aliases": [ "CVE-2025-67638", "GHSA-hxjg-2jvf-h3rx" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2knp-8apg-puaj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49401?format=api", "vulnerability_id": "VCID-8hkw-emg4-3ff5", "summary": "Jenkins has a CSRF vulnerability on the login form\nA cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.", "references": [ { "reference_url": "https://github.com/jenkinsci/jenkins", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/jenkinsci/jenkins" }, { "reference_url": "https://github.com/jenkinsci/jenkins/commit/31598feb0aa514d8978d2c27a4c9a5a9b8d80a57", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/jenkinsci/jenkins/commit/31598feb0aa514d8978d2c27a4c9a5a9b8d80a57" }, { "reference_url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1166", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1166" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67639", "reference_id": "CVE-2025-67639", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67639" }, { "reference_url": "https://github.com/advisories/GHSA-6837-qgrc-x5p6", "reference_id": "GHSA-6837-qgrc-x5p6", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-6837-qgrc-x5p6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/72861?format=api", "purl": "pkg:maven/org.jenkins-ci.main/jenkins-core@2.528.3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.528.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/72860?format=api", "purl": "pkg:maven/org.jenkins-ci.main/jenkins-core@2.541", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.541" } ], "aliases": [ "CVE-2025-67639", "GHSA-6837-qgrc-x5p6" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8hkw-emg4-3ff5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49400?format=api", "vulnerability_id": "VCID-f7nu-h1ds-pbds", "summary": "Jenkins's build authorization token is stored and displayed in plain text\nJenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.", "references": [ { "reference_url": "https://github.com/jenkinsci/jenkins", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/jenkinsci/jenkins" }, { "reference_url": "https://github.com/jenkinsci/jenkins/commit/4710d65339251aaf1d1599f19545db99be24d981", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/jenkinsci/jenkins/commit/4710d65339251aaf1d1599f19545db99be24d981" }, { "reference_url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67637", "reference_id": "CVE-2025-67637", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67637" }, { "reference_url": "https://github.com/advisories/GHSA-fxj7-6v9w-xc76", "reference_id": "GHSA-fxj7-6v9w-xc76", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-fxj7-6v9w-xc76" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/72861?format=api", "purl": "pkg:maven/org.jenkins-ci.main/jenkins-core@2.528.3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.528.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/72860?format=api", "purl": "pkg:maven/org.jenkins-ci.main/jenkins-core@2.541", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.541" } ], "aliases": [ "CVE-2025-67637", "GHSA-fxj7-6v9w-xc76" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-f7nu-h1ds-pbds" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49390?format=api", "vulnerability_id": "VCID-gsam-fjs6-ukdr", "summary": "Jenkins is missing a permission check on password fields\nA missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.", "references": [ { "reference_url": "https://github.com/jenkinsci/jenkins", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/jenkinsci/jenkins" }, { "reference_url": "https://github.com/jenkinsci/jenkins/commit/3ee7380c5e167fab865f58b52a81ef01c24b9eb2", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/jenkinsci/jenkins/commit/3ee7380c5e167fab865f58b52a81ef01c24b9eb2" }, { "reference_url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1809", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1809" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67636", "reference_id": "CVE-2025-67636", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67636" }, { "reference_url": "https://github.com/advisories/GHSA-p3f5-98cv-562j", "reference_id": "GHSA-p3f5-98cv-562j", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-p3f5-98cv-562j" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/72861?format=api", "purl": "pkg:maven/org.jenkins-ci.main/jenkins-core@2.528.3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.528.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/72860?format=api", "purl": "pkg:maven/org.jenkins-ci.main/jenkins-core@2.541", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.541" } ], "aliases": [ "CVE-2025-67636", "GHSA-p3f5-98cv-562j" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gsam-fjs6-ukdr" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49393?format=api", "vulnerability_id": "VCID-sq8g-te16-9qcj", "summary": "Jenkins has a Denial of service vulnerability in HTTP-based CLI\nJenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.", "references": [ { "reference_url": "https://fluidattacks.com/blog/unauth-dos-in-jenkins-cli", "reference_id": "", "reference_type": "", "scores": [], "url": "https://fluidattacks.com/blog/unauth-dos-in-jenkins-cli" }, { "reference_url": "https://github.com/jenkinsci/jenkins", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/jenkinsci/jenkins" }, { "reference_url": "https://github.com/jenkinsci/jenkins/commit/efa1816322026f2b9235a27eee814bcc7ba0a764", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/jenkinsci/jenkins/commit/efa1816322026f2b9235a27eee814bcc7ba0a764" }, { "reference_url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3630", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3630" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67635", "reference_id": "CVE-2025-67635", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67635" }, { "reference_url": "https://github.com/advisories/GHSA-9p56-p6mw-w8qc", "reference_id": "GHSA-9p56-p6mw-w8qc", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-9p56-p6mw-w8qc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/72861?format=api", "purl": "pkg:maven/org.jenkins-ci.main/jenkins-core@2.528.3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.528.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/72860?format=api", "purl": "pkg:maven/org.jenkins-ci.main/jenkins-core@2.541", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.541" } ], "aliases": [ "CVE-2025-67635", "GHSA-9p56-p6mw-w8qc" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-sq8g-te16-9qcj" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.541" }