WaratekVRT Sign in
Reset
More filters (1)
Columns
Vendor org.jenkins-ci.plugins✕
Overview 14 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC
14matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 14 100.0%
Critical 0 0.0% High 0 0.0% Medium 14 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 14 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 14 100.0% No public exploit 0 0.0%
split by peak 5 / quarter
No exploit published: 14 Medium: 14 not blocked: 14 Forecast only: 14
Q1 213 No exploit published3 Medium3 not blocked3 Forecast only3 Q2 213 No exploit published3 Medium3 not blocked3 Forecast only3 Q3 210 Q4 210 Q1 221 No exploit published1 Medium1 not blocked1 Forecast only1 Q2 225 No exploit published5 Medium5 not blocked5 Forecast only5 Q3 220 Q4 220 Q1 231 No exploit published1 Medium1 not blocked1 Forecast only1 Q2 230 Q3 230 Q4 230 Q1 241 No exploit published1 Medium1 not blocked1 Forecast only1
Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23Q1 24
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-28156 Medium 2024-03-06 No exploit published Forecast only Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure Build Monitor Views.
CVE-2023-25762 Medium 2023-02-15 No exploit published Forecast only Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.
CVE-2022-34783 Medium 2022-06-30 No exploit published Forecast only Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34777 Medium 2022-06-30 No exploit published Forecast only Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34176 Medium 2022-06-23 No exploit published Forecast only Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.
CVE-2022-30956 Medium 2022-05-17 No exploit published Forecast only Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads.
CVE-2022-29036 Medium 2022-04-12 No exploit published Forecast only Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-20615 Medium 2022-01-12 No exploit published Forecast only Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
CVE-2021-21668 Medium 2021-06-16 No exploit published Forecast only Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
CVE-2021-21667 Medium 2021-06-16 No exploit published Forecast only Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
CVE-2021-21649 Medium 2021-05-11 No exploit published Forecast only Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
CVE-2021-21630 Medium 2021-03-30 No exploit published Forecast only Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVE-2021-21628 Medium 2021-03-30 No exploit published Forecast only Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVE-2021-21618 Medium 2021-02-24 No exploit published Forecast only Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.