WaratekVRT Sign in
Reset
More filters (1)
Columns
Vendor org.jenkins-ci.plugins✕
Overview 8 matches · 0 protected · 3 exploited · 0 CISA KEV · 4 EPSS ≥ 0.5
8matches 0protected0.0% 3exploited37.5% 0CISA KEV0.0% 4EPSS ≥ 0.550.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 8 100.0% No exploit published 0 0.0%
Critical 0 0.0% High 5 62.5% Medium 3 37.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 8 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 37.5% Working exploit published 5 62.5% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 4 / year
Mitigation candidate: 8 Medium: 3High: 5 not blocked: 8 Working exploit published: 5Exploited: 3
20131 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20140 20150 20160 20170 20181 Mitigation candidate1 High1 not blocked1 Working exploit published1 20194 Mitigation candidate4 High3 Medium1 not blocked4 Exploited2 Working exploit published2 20201 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20210 20221 Mitigation candidate1 High1 not blocked1 Exploited1
2013201420152016201720182019202020212022
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-36883 High 2022-07-27 Mitigation candidate Exploited A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
CVE-2020-2140 Medium 2020-03-09 Mitigation candidate Working exploit published Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
CVE-2019-10475 Medium 2019-10-23 Mitigation candidate Working exploit published A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
CVE-2019-1003005 High 2019-02-06 Mitigation candidate Working exploit published A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
CVE-2019-1003001 High 2019-01-22 Mitigation candidate Exploited A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
CVE-2019-1003000 High 2019-01-22 Mitigation candidate Exploited A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
CVE-2018-8718 High 2018-03-27 Mitigation candidate Working exploit published Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.
CVE-2013-5676 Medium 2013-12-13 Mitigation candidate Working exploit published The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.