Low CWE-325 CVEs

Protected by Waratek 1 50.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 50.0%

Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 2 100.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 1 50.0% partly blocked 0 0.0% not blocked 1 50.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 100.0%

split by StatusSeverityProtectionExploit maturity peak 1 / quarter

Q3 131 Protected by Waratek1 Low1 blocked by ARMR today1 No public exploit1 Q4 130 Q1 140 Q2 140 Q3 140 Q4 140 Q1 150 Q2 150 Q3 150 Q4 150 Q1 160 Q2 160 Q3 160 Q4 160 Q1 170 Q2 170 Q3 170 Q4 170 Q1 180 Q2 181 No exploit published1 Low1 not blocked1 No public exploit1

Q4 13Q2 14Q4 14Q2 15Q4 15Q2 16Q4 16Q2 17Q4 17Q2 18

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2017-2603	Low	2018-05-15	No exploit published	No public exploit	Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362).
CVE-2013-5679	Low	2013-09-30	Protected by Waratek	No public exploit	The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2017-2603

Low

2018-05-15

No exploit published

No public exploit

Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362).

CVE-2013-5679

Low

2013-09-30

Protected by Waratek

No public exploit

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.