WaratekVRT Sign in

Exploited High Workflow CVEs

3 CVEs, 2 protected by Waratek

Reset
More filters (1)
Columns
Product workflow✕
Overview 3 matches · 1 protected · 2 CISA KEV
3matches 1protected33.3% 2CISA KEV66.7%
Protected by Waratek 2 66.7% Rule in development 0 0.0% Mitigation candidate 1 33.3% No exploit published 0 0.0%
Critical 0 0.0% High 3 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 33.3% partly blocked 1 33.3% not blocked 1 33.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / month
Mitigation candidate: 1Protected by Waratek: 2 High: 3 not blocked: 1partly blocked: 1blocked by ARMR today: 1 Exploited: 3
Oct 171 Protected by Waratek1 High1 partly blocked1 Exploited1 Nov 170 Dec 170 Jan 180 Feb 180 Mar 180 Apr 180 May 180 Jun 180 Jul 180 Aug 181 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Sep 180 Oct 180 Nov 180 Dec 180 Jan 191 Mitigation candidate1 High1 not blocked1 Exploited1
Nov 17Jan 18Mar 18May 18Jul 18Sep 18Nov 18Jan 19
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-1003001 High 2019-01-22 Mitigation candidate Exploited A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
CVE-2018-11776 High 2018-08-22 Protected by Waratek Exploited Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
CVE-2017-12617 High 2017-10-04 Protected by Waratek Exploited When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.