WaratekVRT Sign in

Medium Jenkins CVEs with a working exploit

8 CVEs

Reset
More filters (1)
Columns
Vendor jenkins✕
Overview 8 matches · 0 protected · 0 exploited · 0 CISA KEV · 4 EPSS ≥ 0.5
8matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 4EPSS ≥ 0.550.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 8 100.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 8 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 8 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 8 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 5 / year
Mitigation candidate: 8 Medium: 8 not blocked: 8 Working exploit published: 8
20131 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20140 20150 20160 20170 20180 20192 Mitigation candidate2 Medium2 not blocked2 Working exploit published2 20205 Mitigation candidate5 Medium5 not blocked5 Working exploit published5
20132014201520162017201820192020
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-2231 Medium 2020-08-12 Mitigation candidate Working exploit published Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.
CVE-2020-2230 Medium 2020-08-12 Mitigation candidate Working exploit published Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.
CVE-2020-2229 Medium 2020-08-12 Mitigation candidate Working exploit published Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
CVE-2020-2140 Medium 2020-03-09 Mitigation candidate Working exploit published Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
CVE-2020-2103 Medium 2020-01-29 Mitigation candidate Working exploit published Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.
CVE-2019-10475 Medium 2019-10-23 Mitigation candidate Working exploit published A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
CVE-2019-10405 Medium 2019-09-25 Mitigation candidate Working exploit published Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
CVE-2013-5573 Medium 2013-12-31 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.