Medium Org.jvnet.hudson.plugins CVEs
30 CVEs, 4 protected by Waratek
Overview 30 matches · 4 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
4
13.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
26
86.7%
blocked by ARMR today
4
13.3%
partly blocked
0
0.0%
not blocked
26
86.7%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
30
100.0%
split by
peak 9 / year
20142
No exploit published2
Medium2
not blocked2
No public exploit2
20150
20160
20173
No exploit published3
Medium3
not blocked3
No public exploit3
20183
No exploit published3
Medium3
not blocked3
No public exploit3
20197
No exploit published7
Medium7
not blocked7
No public exploit7
20209
Protected by Waratek3
No exploit published6
Medium9
blocked by ARMR today3
not blocked6
No public exploit9
20211
No exploit published1
Medium1
not blocked1
No public exploit1
20224
No exploit published4
Medium4
not blocked4
No public exploit4
20231
Protected by Waratek1
Medium1
blocked by ARMR today1
No public exploit1
2014201520162017201820192020202120222023
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-24449 | Medium | 2023-01-26 | Protected by Waratek | No public exploit | Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. |
| CVE-2022-30967 | Medium | 2022-05-17 | No exploit published | No public exploit | Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-28153 | Medium | 2022-03-29 | No exploit published | No public exploit | Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-28135 | Medium | 2022-03-29 | No exploit published | No public exploit | Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
| CVE-2022-27196 | Medium | 2022-03-15 | No exploit published | No public exploit | Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions. |
| CVE-2021-21634 | Medium | 2021-03-30 | No exploit published | No public exploit | Jenkins Jabber (XMPP) notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
| CVE-2020-2317 | Medium | 2020-11-04 | No exploit published | No public exploit | Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to Jenkins FindBugs Plugin's post build step. |
| CVE-2020-2316 | Medium | 2020-11-04 | No exploit published | No public exploit | Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2020-2278 | Medium | 2020-09-16 | Protected by Waratek | No public exploit | Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any other '.xml' file on the Jenkins controller with a job config.xml file's content. |
| CVE-2020-2277 | Medium | 2020-09-16 | Protected by Waratek | No public exploit | Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller. |
| CVE-2020-2275 | Medium | 2020-09-16 | Protected by Waratek | No public exploit | Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing attackers with Job/Configure permission to read arbitrary files on the Jenkins controller. |
| CVE-2020-2271 | Medium | 2020-09-16 | No exploit published | No public exploit | Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2020-2270 | Medium | 2020-09-16 | No exploit published | No public exploit | Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2020-2262 | Medium | 2020-09-16 | No exploit published | No public exploit | Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to the plugin's post-build step. |
| CVE-2020-2152 | Medium | 2020-03-09 | No exploit published | No public exploit | Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflected cross-site scripting vulnerability. |
| CVE-2019-10317 | Medium | 2019-04-30 | No exploit published | No public exploit | Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM. |
| CVE-2019-10308 | Medium | 2019-04-30 | No exploit published | No public exploit | A missing permission check in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers with Overall/Read permission to change the per-job default graph configuration for all users. |
| CVE-2019-10307 | Medium | 2019-04-30 | No exploit published | No public exploit | A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers to change the per-job default graph configuration for all users. |
| CVE-2019-1003059 | Medium | 2019-04-04 | No exploit published | No public exploit | A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server. |
| CVE-2019-1003058 | Medium | 2019-04-04 | No exploit published | No public exploit | A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers to initiate a connection to an attacker-specified server. |
| CVE-2019-1003022 | Medium | 2019-02-06 | No exploit published | No public exploit | A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master. |
| CVE-2018-1000419 | Medium | 2019-01-09 | No exploit published | No public exploit | An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins. |
| CVE-2018-1000147 | Medium | 2018-04-05 | No exploit published | No public exploit | An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with insufficient permission to obtain Perforce passwords configured in jobs to obtain them |
| CVE-2018-1000145 | Medium | 2018-04-05 | No exploit published | No public exploit | An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with local file system access to obtain encrypted Perforce passwords and decrypt them. |
| CVE-2017-1000402 | Medium | 2018-01-26 | No exploit published | No public exploit | Jenkins Swarm Plugin Client 3.4 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. |
| CVE-2017-1000243 | Medium | 2017-11-01 | No exploit published | No public exploit | Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites |
| CVE-2017-1000103 | Medium | 2017-10-05 | No exploit published | No public exploit | The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view. |
| CVE-2017-1000102 | Medium | 2017-10-05 | No exploit published | No public exploit | The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to these plugins, for example the console output which is parsed to extract build warnings (Warnings Plugin), could insert arbitrary HTML into this view. |
| CVE-2014-3679 | Medium | 2014-10-16 | No exploit published | No public exploit | The Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to obtain sensitive information by accessing unspecified pages. |
| CVE-2014-3678 | Medium | 2014-10-10 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |