WaratekVRT Sign in
Reset
More filters (2)
Columns
Protection: None✕Product openshift✕
Overview 114 matches · 0 protected · 4 exploited · 1 CISA KEV · 7 public PoC · 5 EPSS ≥ 0.5
114matches 0protected0.0% 4exploited3.5% 1CISA KEV0.9% 7public PoC6.1% 5EPSS ≥ 0.54.4%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 7 6.1% No exploit published 107 93.9%
Critical 5 4.4% High 41 36.0% Medium 65 57.0% Low 3 2.6% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 114 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 3.5% Working exploit published 2 1.8% Proof of concept only 1 0.9% Forecast only 0 0.0% No public exploit 107 93.9%
split by peak 23 / year
No exploit published: 107Mitigation candidate: 7 Low: 3Medium: 65High: 41Critical: 5 not blocked: 114 No public exploit: 107Proof of concept only: 1Working exploit published: 2Exploited: 4
20147 No exploit published7 High1 Medium6 not blocked7 No public exploit7 201513 No exploit published13 High2 Medium10 Low1 not blocked13 No public exploit13 201614 Mitigation candidate1 No exploit published13 Critical1 High5 Medium8 not blocked14 Working exploit published1 No public exploit13 20170 20186 No exploit published6 High2 Medium4 not blocked6 No public exploit6 201923 Mitigation candidate3 No exploit published20 Critical2 High12 Medium9 not blocked23 Exploited2 Working exploit published1 No public exploit20 202015 No exploit published15 Critical1 High5 Medium9 not blocked15 No public exploit15 20215 No exploit published5 High1 Medium2 Low2 not blocked5 No public exploit5 202210 No exploit published10 High3 Medium7 not blocked10 No public exploit10 202316 Mitigation candidate2 No exploit published14 Critical1 High8 Medium7 not blocked16 Exploited1 Proof of concept only1 No public exploit14 20244 Mitigation candidate1 No exploit published3 High2 Medium2 not blocked4 Exploited1 No public exploit3 20251 No exploit published1 Medium1 not blocked1 No public exploit1
201420152016201720182019202020212022202320242025
114 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2015-5318 Medium 2015-11-25 No exploit published No public exploit Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.
CVE-2015-1814 High 2015-10-16 No exploit published No public exploit The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.
CVE-2015-1813 Medium 2015-10-16 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1812.
CVE-2015-1812 Medium 2015-10-16 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.
CVE-2015-1810 Medium 2015-10-16 No exploit published No public exploit The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.
CVE-2015-1808 Low 2015-10-16 No exploit published No public exploit Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data.
CVE-2015-1806 Medium 2015-10-16 No exploit published No public exploit The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.
CVE-2014-3680 Medium 2014-10-16 No exploit published No public exploit Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized job by reading the DOM.
CVE-2014-3667 Medium 2014-10-16 No exploit published No public exploit Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.
CVE-2014-3666 High 2014-10-16 No exploit published No public exploit Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.
CVE-2014-3663 Medium 2014-10-16 No exploit published No public exploit Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary jobs via unspecified vectors.
CVE-2014-3662 Medium 2014-10-16 No exploit published No public exploit Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts.
CVE-2014-3661 Medium 2014-10-16 No exploit published No public exploit Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.
CVE-2014-3681 Medium 2014-10-15 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
‹ prev page 2 of 2 next ›