WaratekVRT Sign in
Reset
More filters (1)
Columns
Published to 2022-06-30✕
Overview 7,566 matches · 786 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
7,566matches 786protected10.4% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 786 10.4% Rule in development 0 0.0% Mitigation candidate 2 0.0% No exploit published 6,778 89.6%
Critical 452 6.0% High 2,329 30.8% Medium 4,276 56.5% Low 509 6.7% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 786 10.4% partly blocked 0 0.0% not blocked 6,780 89.6% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7,566 100.0%
split by peak 1,013 / year
No exploit published: 6,778Mitigation candidate: 2Protected by Waratek: 786 Low: 509Medium: 4,276High: 2,329Critical: 452 not blocked: 6,780blocked by ARMR today: 786 No public exploit: 7,566
19961 No exploit published1 High1 not blocked1 No public exploit1 19970 19980 19992 No exploit published2 High2 not blocked2 No public exploit2 20006 No exploit published6 High3 Medium3 not blocked6 No public exploit6 200111 Protected by Waratek1 No exploit published10 High7 Medium4 blocked by ARMR today1 not blocked10 No public exploit11 200227 Protected by Waratek3 No exploit published24 High9 Medium16 Low2 blocked by ARMR today3 not blocked24 No public exploit27 200331 Protected by Waratek1 No exploit published30 High7 Medium19 Low5 blocked by ARMR today1 not blocked30 No public exploit31 200426 Protected by Waratek2 No exploit published24 High6 Medium17 Low3 blocked by ARMR today2 not blocked24 No public exploit26 200577 Protected by Waratek2 No exploit published75 Critical1 High30 Medium41 Low5 blocked by ARMR today2 not blocked75 No public exploit77 2006127 Protected by Waratek6 No exploit published121 High65 Medium51 Low11 blocked by ARMR today6 not blocked121 No public exploit127 2007139 Protected by Waratek5 No exploit published134 High67 Medium62 Low10 blocked by ARMR today5 not blocked134 No public exploit139 2008122 Protected by Waratek2 No exploit published120 High44 Medium71 Low7 blocked by ARMR today2 not blocked120 No public exploit122 2009186 Protected by Waratek5 No exploit published181 High47 Medium118 Low21 blocked by ARMR today5 not blocked181 No public exploit186 2010165 Protected by Waratek4 No exploit published161 Critical1 High25 Medium119 Low20 blocked by ARMR today4 not blocked161 No public exploit165 2011181 Protected by Waratek3 No exploit published178 High15 Medium134 Low32 blocked by ARMR today3 not blocked178 No public exploit181 2012284 Protected by Waratek6 No exploit published278 High27 Medium181 Low76 blocked by ARMR today6 not blocked278 No public exploit284 2013321 Protected by Waratek16 Mitigation candidate1 No exploit published304 High37 Medium232 Low52 blocked by ARMR today16 not blocked305 No public exploit321 2014314 Protected by Waratek32 No exploit published282 High24 Medium241 Low49 blocked by ARMR today32 not blocked282 No public exploit314 2015310 Protected by Waratek25 No exploit published285 Critical1 High41 Medium221 Low47 blocked by ARMR today25 not blocked285 No public exploit310 2016503 Protected by Waratek39 No exploit published464 Critical39 High120 Medium311 Low33 blocked by ARMR today39 not blocked464 No public exploit503 2017760 Protected by Waratek79 No exploit published681 Critical65 High325 Medium345 Low25 blocked by ARMR today79 not blocked681 No public exploit760 2018851 Protected by Waratek154 No exploit published697 Critical69 High291 Medium477 Low14 blocked by ARMR today154 not blocked697 No public exploit851 2019848 Protected by Waratek94 No exploit published754 Critical72 High314 Medium431 Low31 blocked by ARMR today94 not blocked754 No public exploit848 20201,013 Protected by Waratek124 Mitigation candidate1 No exploit published888 Critical84 High362 Medium527 Low40 blocked by ARMR today124 not blocked889 No public exploit1,013 2021718 Protected by Waratek95 No exploit published623 Critical80 High322 Medium299 Low17 blocked by ARMR today95 not blocked623 No public exploit718 2022543 Protected by Waratek88 No exploit published455 Critical40 High138 Medium356 Low9 blocked by ARMR today88 not blocked455 No public exploit543
199820012004200720102013201620192022
7,566 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 76 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2022-34818 Medium 2022-06-30 No exploit published No public exploit Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs.
CVE-2022-34817 Medium 2022-06-30 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs.
CVE-2022-34816 Medium 2022-06-30 No exploit published No public exploit Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34815 Medium 2022-06-30 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, thereby renaming or deleting jobs.
CVE-2022-34814 Medium 2022-06-30 No exploit published No public exploit Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending requests.
CVE-2022-34813 Medium 2022-06-30 No exploit published No public exploit A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XPath expressions.
CVE-2022-34812 Medium 2022-06-30 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath expressions.
CVE-2022-34811 Medium 2022-06-30 No exploit published No public exploit A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to access the XPath Configuration Viewer page.
CVE-2022-34810 Medium 2022-06-30 No exploit published No public exploit A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-34809 Medium 2022-06-30 No exploit published No public exploit Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34808 Medium 2022-06-30 No exploit published No public exploit Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34807 Medium 2022-06-30 No exploit published No public exploit Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34806 Medium 2022-06-30 No exploit published No public exploit Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVE-2022-34805 Medium 2022-06-30 No exploit published No public exploit Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34804 Medium 2022-06-30 No exploit published No public exploit Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure.
CVE-2022-34803 Medium 2022-06-30 No exploit published No public exploit Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission (config.xml), or access to the Jenkins controller file system.
CVE-2022-34802 Medium 2022-06-30 No exploit published No public exploit Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34801 Medium 2022-06-30 No exploit published No public exploit Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2022-34800 Medium 2022-06-30 No exploit published No public exploit Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34799 Medium 2022-06-30 No exploit published No public exploit Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34798 Medium 2022-06-30 No exploit published No public exploit Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVE-2022-34797 Medium 2022-06-30 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVE-2022-34796 Medium 2022-06-30 No exploit published No public exploit A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-34795 Medium 2022-06-30 No exploit published No public exploit Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
CVE-2022-34794 Medium 2022-06-30 No exploit published No public exploit Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.
CVE-2022-34793 High 2022-06-30 Protected by Waratek No public exploit Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-34792 High 2022-06-30 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML.
CVE-2022-34791 Medium 2022-06-30 No exploit published No public exploit Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34790 Medium 2022-06-30 No exploit published No public exploit Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34789 Medium 2022-06-30 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous matrix builds.
CVE-2022-34788 Medium 2022-06-30 No exploit published No public exploit Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
CVE-2022-34787 Medium 2022-06-30 No exploit published No public exploit Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control the reason a queue item is blocked.
CVE-2022-34786 Medium 2022-06-30 No exploit published No public exploit Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
CVE-2022-34785 Medium 2022-06-30 No exploit published No public exploit Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them.
CVE-2022-34784 Medium 2022-06-30 No exploit published No public exploit Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update permission.
CVE-2022-34782 Medium 2022-06-30 No exploit published No public exploit An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests.
CVE-2022-34781 Medium 2022-06-30 No exploit published No public exploit Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2022-34780 Medium 2022-06-30 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2022-34779 Medium 2022-06-30 No exploit published No public exploit A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-34778 Medium 2022-06-30 No exploit published No public exploit Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results.
CVE-2022-33879 Low 2022-06-27 No exploit published No public exploit The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
CVE-2022-26477 High 2022-06-27 Protected by Waratek No public exploit The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a "low-priority but useful improvement". SystemDS is a distributed system and needs to serialize/deserialize data but in many code paths (e.g., on Spark broadcast/shuffle or writing to sequence files) the byte stream is anyway protected by additional CRC fingerprints. In this particular case though, the number of decoders is upper-bounded by twice the number of columns, which means an attacker would need to modify two entries in the byte stream in a consistent manner. By adding these checks robustness was strictly improved with almost zero overhead. These code changes are available in versions higher than 2.2.1.
CVE-2022-34298 Medium 2022-06-23 No exploit published No public exploit The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."
CVE-2022-34213 Medium 2022-06-23 No exploit published No public exploit Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34212 Medium 2022-06-23 No exploit published No public exploit A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified URL.
CVE-2022-34211 Medium 2022-06-23 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an attacker-specified URL.
CVE-2022-34210 Medium 2022-06-23 No exploit published No public exploit A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-34209 Medium 2022-06-23 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-specified URL.
CVE-2022-34208 Medium 2022-06-23 No exploit published No public exploit A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-34207 Medium 2022-06-23 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers to connect to an attacker-specified URL.
CVE-2022-34206 Medium 2022-06-23 No exploit published No public exploit A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL.
CVE-2022-34205 Medium 2022-06-23 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an attacker-specified URL.
CVE-2022-34204 Medium 2022-06-23 No exploit published No public exploit A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
CVE-2022-34203 High 2022-06-23 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins EasyQA Plugin 1.0 and earlier allows attackers to connect to an attacker-specified HTTP server.
CVE-2022-34202 Medium 2022-06-23 No exploit published No public exploit Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34201 Medium 2022-06-23 No exploit published No public exploit A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-34200 High 2022-06-23 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect to an attacker-specified URL.
CVE-2022-34199 Medium 2022-06-23 No exploit published No public exploit Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVE-2022-34198 Medium 2022-06-23 No exploit published No public exploit Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34197 Medium 2022-06-23 No exploit published No public exploit Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34196 Medium 2022-06-23 No exploit published No public exploit Jenkins REST List Parameter Plugin 1.5.2 and earlier does not escape the name and description of REST list parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34195 Medium 2022-06-23 No exploit published No public exploit Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34194 Medium 2022-06-23 No exploit published No public exploit Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34193 Medium 2022-06-23 No exploit published No public exploit Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34192 Medium 2022-06-23 No exploit published No public exploit Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, and Ontrack: SingleParameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34191 Medium 2022-06-23 No exploit published No public exploit Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34190 Medium 2022-06-23 No exploit published No public exploit Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact versions parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34189 Medium 2022-06-23 No exploit published No public exploit Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34188 Medium 2022-06-23 No exploit published No public exploit Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34187 Medium 2022-06-23 No exploit published No public exploit Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34186 Medium 2022-06-23 No exploit published No public exploit Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34185 Medium 2022-06-23 No exploit published No public exploit Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34184 Medium 2022-06-23 No exploit published No public exploit Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34183 Medium 2022-06-23 No exploit published No public exploit Jenkins Agent Server Parameter Plugin 1.1 and earlier does not escape the name and description of Agent Server parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34182 Medium 2022-06-23 No exploit published No public exploit Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVE-2022-34181 Critical 2022-06-23 No exploit published No public exploit Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't exist, and parsing files inside it as test results, allowing attackers able to control agent processes to create an arbitrary directory on the Jenkins controller or to obtain test results from existing files in an attacker-specified directory.
CVE-2022-34180 High 2022-06-23 No exploit published No public exploit Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or build.
CVE-2022-34179 High 2022-06-23 Protected by Waratek No public exploit Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to specify paths to other SVG images on the Jenkins controller file system.
CVE-2022-34178 Medium 2022-06-23 No exploit published No public exploit Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVE-2022-34177 High 2022-06-23 Protected by Waratek No public exploit Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.
CVE-2022-34175 High 2022-06-23 No exploit published No public exploit Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view.
CVE-2022-34174 High 2022-06-23 No exploit published No public exploit In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.
CVE-2022-34173 Medium 2022-06-23 Protected by Waratek No public exploit In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVE-2022-34172 Medium 2022-06-23 Protected by Waratek No public exploit In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.
CVE-2022-34171 Medium 2022-06-23 Protected by Waratek No public exploit In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.
CVE-2022-34170 Medium 2022-06-23 Protected by Waratek No public exploit In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVE-2022-33113 Medium 2022-06-23 No exploit published No public exploit Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module.
CVE-2022-32549 Medium 2022-06-22 No exploit published No public exploit Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.
CVE-2022-22979 High 2022-06-21 No exploit published No public exploit In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework.
CVE-2021-41411 Critical 2022-06-16 Protected by Waratek No public exploit drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
CVE-2020-28865 High 2022-06-16 No exploit published No public exploit An issue was discovered in PowerJob through 3.2.2, allows attackers to change arbitrary user passwords via the id parameter to /appinfo/save.
CVE-2022-33140 High 2022-06-15 Protected by Waratek No public exploit The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the default configuration. Command injection requires ShellUserGroupProvider to be one of the enabled User Group Providers in the Authorizers configuration. Command injection also requires an authenticated user with elevated privileges. Apache NiFi requires an authenticated user with authorization to modify access policies in order to execute the command. Apache NiFi Registry requires an authenticated user with authorization to read user groups in order to execute the command. The resolution removes command formatting based on user-provided arguments.
CVE-2022-31044 High 2022-06-15 No exploit published No public exploit Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly not working. Any credentials created or overwritten using Rundeck 4.2.0 or 4.2.1 might result in them being written in plaintext to the backend storage. This affects those using any `Storage Converter` plugin. Rundeck 4.3.1 and 4.2.2 have fixed the code and upon upgrade will re-encrypt any plain text values. Version 4.3.0 does not have the vulnerability, but does not include the patch to re-encrypt plain text values if 4.2.0 or 4.2.1 were used. To prevent plaintext credentials from being stored in Rundeck 4.2.0/4.2.1, write access to key storage can be disabled via ACLs. After upgrading to 4.3.1 or later, write access can be restored.
CVE-2021-33036 High 2022-06-15 Protected by Waratek No public exploit In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
CVE-2022-25167 Critical 2022-06-14 No exploit published No public exploit Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
CVE-2021-40660 High 2022-06-14 No exploit published No public exploit An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack.
CVE-2021-37404 Critical 2022-06-13 No exploit published No public exploit There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
CVE-2022-24969 Medium 2022-06-09 No exploit published No public exploit bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
CVE-2022-29631 High 2022-06-06 No exploit published No public exploit Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload.
CVE-2022-23712 High 2022-06-06 No exploit published No public exploit A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.
‹ prev page 1 of 76 next ›