WaratekVRT Sign in

Medium Oracle Communications ATS Framework (Jenkins) CVEs

12 CVEs

Reset
More filters (1)
Columns
Oracle product: Oracle Communications / ATS Framework (Jenkins)✕
Overview 12 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
12matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 12 100.0%
Critical 0 0.0% High 0 0.0% Medium 12 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 12 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 12 100.0%
split by peak 3 / quarter
No exploit published: 12 Medium: 12 not blocked: 12 No public exploit: 12
Q3 233 No exploit published3 Medium3 not blocked3 No public exploit3 Q4 230 Q1 240 Q2 240 Q3 241 No exploit published1 Medium1 not blocked1 No public exploit1 Q4 242 No exploit published2 Medium2 not blocked2 No public exploit2 Q1 250 Q2 252 No exploit published2 Medium2 not blocked2 No public exploit2 Q3 250 Q4 253 No exploit published3 Medium3 not blocked3 No public exploit3 Q1 261 No exploit published1 Medium1 not blocked1 No public exploit1
Q3 23Q4 23Q1 24Q2 24Q3 24Q4 24Q1 25Q2 25Q3 25Q4 25Q1 26
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-27100 Medium 2026-02-18 No exploit published No public exploit Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.
CVE-2025-67638 Medium 2025-12-10 No exploit published No public exploit Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2025-67637 Medium 2025-12-10 No exploit published No public exploit Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVE-2025-67636 Medium 2025-12-10 No exploit published No public exploit A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.
CVE-2025-31721 Medium 2025-04-02 No exploit published No public exploit A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.
CVE-2025-31720 Medium 2025-04-02 No exploit published No public exploit A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration.
CVE-2024-47804 Medium 2024-10-02 No exploit published No public exploit If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to persist it, effectively bypassing the item creation restriction.
CVE-2024-47803 Medium 2024-10-02 No exploit published No public exploit Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form field.
CVE-2024-43045 Medium 2024-08-07 No exploit published No public exploit Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".
CVE-2023-43495 Medium 2023-09-20 No exploit published No public exploit Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.
CVE-2023-43494 Medium 2023-09-20 No exploit published No public exploit Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.
CVE-2023-39151 Medium 2023-07-26 No exploit published No public exploit Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.