VRT Sign in

Medium Dingding CVEs with no public exploit

3 CVEs

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5

3matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 3 100.0%

Critical 0 0.0% High 0 0.0% Medium 3 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 100.0%

split by StatusSeverityProtectionExploit maturity peak 2 / month

Dec 232 No exploit published2 Medium2 not blocked2 No public exploit2 Jan 240 Feb 240 Mar 240 Apr 240 May 240 Jun 240 Jul 240 Aug 240 Sep 240 Oct 240 Nov 240 Dec 240 Jan 250 Feb 250 Mar 250 Apr 250 May 251 No exploit published1 Medium1 not blocked1 No public exploit1

Jan 24Mar 24May 24Jul 24Sep 24Nov 24Jan 25Mar 25May 25

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2025-47888	Medium	2025-05-14	No exploit published	No public exploit	Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks.
CVE-2023-50773	Medium	2023-12-13	No exploit published	No public exploit	Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2023-50772	Medium	2023-12-13	No exploit published	No public exploit	Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2025-47888

Medium

2025-05-14

No exploit published

No public exploit

Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks.

CVE-2023-50773

Medium

2023-12-13

No exploit published

No public exploit

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

CVE-2023-50772

Medium

2023-12-13

No exploit published

No public exploit

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.