WaratekVRT Sign in

High Jenkins CVEs with a working exploit

5 CVEs

Reset
More filters (1)
Columns
Vendor jenkins✕
Overview 5 matches · 0 protected · 0 exploited · 0 CISA KEV · 3 EPSS ≥ 0.5
5matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 3EPSS ≥ 0.560.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 5 100.0% No exploit published 0 0.0%
Critical 0 0.0% High 5 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 5 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 5 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / quarter
Mitigation candidate: 5 High: 5 not blocked: 5 Working exploit published: 5
Q2 161 Mitigation candidate1 High1 not blocked1 Working exploit published1 Q3 160 Q4 160 Q1 170 Q2 170 Q3 170 Q4 170 Q1 181 Mitigation candidate1 High1 not blocked1 Working exploit published1 Q2 180 Q3 181 Mitigation candidate1 High1 not blocked1 Working exploit published1 Q4 180 Q1 192 Mitigation candidate2 High2 not blocked2 Working exploit published2
Q2 16Q3 16Q4 16Q1 17Q2 17Q3 17Q4 17Q1 18Q2 18Q3 18Q4 18Q1 19
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-1003005 High 2019-02-06 Mitigation candidate Working exploit published A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
CVE-2019-1003002 High 2019-01-22 Mitigation candidate Working exploit published A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
CVE-2018-1999002 High 2018-07-23 Mitigation candidate Working exploit published A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
CVE-2018-8718 High 2018-03-27 Mitigation candidate Working exploit published Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.
CVE-2016-0792 High 2016-04-07 Mitigation candidate Working exploit published Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.