WaratekVRT Sign in
Reset
More filters (1)
Columns
Product deploy✕
Overview 9 matches · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
9matches 0exploited0.0% 0CISA KEV0.0% 1public PoC11.1% 0EPSS ≥ 0.50.0%
Protected by Waratek 9 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 2 22.2% High 4 44.4% Medium 3 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 9 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 11.1% Forecast only 0 0.0% No public exploit 8 88.9%
split by peak 3 / quarter
Protected by Waratek: 9 Medium: 3High: 4Critical: 2 blocked by ARMR today: 9 No public exploit: 8Proof of concept only: 1
Q1 191 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q2 190 Q3 192 Protected by Waratek2 Critical1 High1 blocked by ARMR today2 Proof of concept only1 No public exploit1 Q4 190 Q1 202 Protected by Waratek2 High2 blocked by ARMR today2 No public exploit2 Q2 200 Q3 200 Q4 200 Q1 210 Q2 210 Q3 210 Q4 210 Q1 221 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q2 220 Q3 223 Protected by Waratek3 High1 Medium2 blocked by ARMR today3 No public exploit3
Q1 19Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-41235 Medium 2022-09-21 Protected by Waratek No public exploit Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.
CVE-2022-36890 Medium 2022-07-27 Protected by Waratek No public exploit Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
CVE-2022-36889 High 2022-07-27 Protected by Waratek No public exploit Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.
CVE-2022-27208 Medium 2022-03-15 Protected by Waratek No public exploit Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on the Jenkins controller.
CVE-2020-2171 High 2020-03-25 Protected by Waratek No public exploit Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2020-2108 High 2020-01-29 Protected by Waratek No public exploit Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions.
CVE-2019-14439 High 2019-07-30 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVE-2019-14379 Critical 2019-07-29 Protected by Waratek No public exploit SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
CVE-2018-14718 Critical 2019-01-02 Protected by Waratek No public exploit FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.