WaratekVRT Sign in

Critical Script Security CVEs

8 CVEs, 1 exploited, 2 protected by Waratek

Reset
More filters (1)
Columns
Product script security✕
Overview 8 matches · 2 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
8matches 2protected25.0% 1exploited12.5% 1CISA KEV12.5% 1public PoC12.5% 1EPSS ≥ 0.512.5%
Protected by Waratek 2 25.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 6 75.0%
Critical 8 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 25.0% partly blocked 0 0.0% not blocked 6 75.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 12.5% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7 87.5%
split by peak 3 / quarter
No exploit published: 6Protected by Waratek: 2 Critical: 8 not blocked: 6blocked by ARMR today: 2 No public exploit: 7Exploited: 1
Q1 192 Protected by Waratek2 Critical2 blocked by ARMR today2 Exploited1 No public exploit1 Q2 190 Q3 190 Q4 191 No exploit published1 Critical1 not blocked1 No public exploit1 Q1 200 Q2 200 Q3 201 No exploit published1 Critical1 not blocked1 No public exploit1 Q4 200 Q1 210 Q2 210 Q3 210 Q4 210 Q1 220 Q2 220 Q3 220 Q4 223 No exploit published3 Critical3 not blocked3 No public exploit3 Q1 230 Q2 230 Q3 230 Q4 230 Q1 240 Q2 241 No exploit published1 Critical1 not blocked1 No public exploit1
Q2 19Q4 19Q2 20Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-34144 Critical 2024-05-02 No exploit published No public exploit A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVE-2022-43404 Critical 2022-10-19 No exploit published No public exploit A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVE-2022-43403 Critical 2022-10-19 No exploit published No public exploit A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVE-2022-43401 Critical 2022-10-19 No exploit published No public exploit A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVE-2020-2279 Critical 2020-09-23 No exploit published No public exploit A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide crafted return values or script binding content that can result in arbitrary code execution on the Jenkins controller JVM.
CVE-2019-10431 Critical 2019-10-01 No exploit published No public exploit A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.
CVE-2019-1003040 Critical 2019-03-28 Protected by Waratek No public exploit A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
CVE-2019-1003029 Critical 2019-03-08 Protected by Waratek Exploited A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.