Overview 9 matches · 1 protected · 0 exploited · 0 CISA KEV · 5 EPSS ≥ 0.5
Protected by Waratek
1
11.1%
Rule in development
0
0.0%
Mitigation candidate
8
88.9%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
0
0.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
11.1%
partly blocked
0
0.0%
not blocked
8
88.9%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
9
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 4 / year
20131
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
20140
20151
Protected by Waratek1
Critical1
blocked by ARMR today1
Working exploit published1
20161
Mitigation candidate1
High1
not blocked1
Working exploit published1
20170
20181
Mitigation candidate1
High1
not blocked1
Working exploit published1
20191
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
20204
Mitigation candidate4
Medium4
not blocked4
Working exploit published4
20132014201520162017201820192020
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2020-2231 | Medium | 2020-08-12 | Mitigation candidate | Working exploit published | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token. |
| CVE-2020-2230 | Medium | 2020-08-12 | Mitigation candidate | Working exploit published | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission. |
| CVE-2020-2229 | Medium | 2020-08-12 | Mitigation candidate | Working exploit published | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability. |
| CVE-2020-2103 | Medium | 2020-01-29 | Mitigation candidate | Working exploit published | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page. |
| CVE-2019-10405 | Medium | 2019-09-25 | Mitigation candidate | Working exploit published | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly. |
| CVE-2018-1999002 | High | 2018-07-23 | Mitigation candidate | Working exploit published | A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to. |
| CVE-2016-0792 | High | 2016-04-07 | Mitigation candidate | Working exploit published | Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando. |
| CVE-2015-8103 | Critical | 2015-11-25 | Protected by Waratek | Working exploit published | The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'". |
| CVE-2013-5573 | Medium | 2013-12-31 | Mitigation candidate | Working exploit published | Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration. |