Overview 6 matches · 5 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
5
83.3%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
1
16.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
6
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
6
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 3 / year
20131
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
20140
20150
20160
20170
20181
Mitigation candidate1
High1
not blocked1
Working exploit published1
20193
Mitigation candidate2
Not applicable1
High1
Medium2
not blocked3
Working exploit published3
20201
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
20132014201520162017201820192020
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2020-2140 | Medium | 2020-03-09 | Mitigation candidate | Working exploit published | Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability. |
| CVE-2019-10475 | Medium | 2019-10-23 | Mitigation candidate | Working exploit published | A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin. |
| CVE-2019-10349 | Medium | 2019-07-11 | Not applicable | Working exploit published | A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins. |
| CVE-2019-1003005 | High | 2019-02-06 | Mitigation candidate | Working exploit published | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM. |
| CVE-2018-8718 | High | 2018-03-27 | Mitigation candidate | Working exploit published | Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request. |
| CVE-2013-5676 | Medium | 2013-12-13 | Mitigation candidate | Working exploit published | The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure. |