Advisories · Technology
JumpServer.
Every CVE that names JumpServer among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
JumpServer Template Rendering os command injection
- JumpServer
- Command injection
- CVSS 6.0 Medium
JumpServer: Ansible Automation Template Rendering Allows Unsafe Lookup Plugin Invocation
- jumpserver
- Code injection
- CVSS 6.2 Medium
JumpServer: Privilege Overwrite via Organization Invite Logic Flaw
- jumpserver
- Broken access control
- CVSS 6.7 Medium
JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment
- jumpserver
- Code injection
- CVSS 5.4 Medium
JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset
- jumpserver
- Path traversal
- CVSS 6.8 Medium
JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering
- jumpserver
- Code injection
- CVSS 5.0 Medium
JumpServer Improper Certificate Validation in Custom SMS API Client
- jumpserver
- Weak cryptography or TLS
- CVSS 5.5 Medium
JumpServer has an Open Redirect Vulnerability
- jumpserver
- Open redirect
- CVSS 7.1 High
JumpServer Unauthorized LDAP Configuration Access via WebSocket
- jumpserver
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+
JumpServer Connection Token Leak Vulnerability
- jumpserver
- Broken access control
- CVSS 4.3 Medium
JumpServer has a Kubernetes Token Leak Vulnerability
- jumpserver
- Privilege escalation
- CVSS 10.0 CriticalCritical · CVSS 9+
Arbitrary File Read in Ansible Playbooks in Jumpserver
- jumpserver
- Path traversal
- CVSS 10.0 CriticalCritical · CVSS 9+
Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver
- jumpserver
- Path traversal
- CVSS 10.0 CriticalCritical · CVSS 9+
JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery
- jumpserver
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
JumpServer's insecure Ansible playbook validation leads to RCE in Celery
- jumpserver
- Code injection
- CVSS 4.6 Medium
JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked
- jumpserver
- Broken access control
- CVSS 4.6 Medium
JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality
- jumpserver
- Broken access control
- CVSS 4.3 Medium
JumpServer Open Redirect Vulnerability
- jumpserver
- Open redirect
- CVSS 3.7 Low
JumpServer default admin user email leak password reset
- jumpserver
- CWE-640
- CVSS 5.3 Medium
jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values
- jumpserver
- Authentication bypass
- CVSS 8.2 High
Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver
- jumpserver
- CWE-640
- CVSS 8.2 High
Non-MFA account takeover via using only SSH public key to login in jumpserver
- jumpserver
- Broken access control
- CVSS 8.9 High
Path traversal in Jumpserver
- jumpserver
- Path traversal
- CVSS 7.0 High
Random seed leakage in Jumpserver
- jumpserver
- Information disclosure
- CVSS 8.2 HighCritical · CVSS 7+ and EPSS
JumpServer session replays download without authentication
- jumpserver
- Authentication bypass
- CVSS 5.7 Medium
JumpServer Koko vulnerable to Command Injection for Kubernetes Connection
- jumpserver
- Command injection