WaratekVRT Sign in

Io.jenkins.plugins CVEs

117 CVEs, 8 protected by Waratek

Reset
More filters (1)
Columns
Vendor io.jenkins.plugins✕
Overview 117 matches · 8 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 2 EPSS ≥ 0.5
117matches 8protected6.8% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 2EPSS ≥ 0.51.7%
Protected by Waratek 8 6.8% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 109 93.2%
Critical 3 2.6% High 31 26.5% Medium 78 66.7% Low 5 4.3% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 8 6.8% partly blocked 0 0.0% not blocked 109 93.2% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 2 1.7% No public exploit 115 98.3%
split by peak 31 / year
No exploit published: 109Protected by Waratek: 8 Low: 5Medium: 78High: 31Critical: 3 not blocked: 109blocked by ARMR today: 8 No public exploit: 115Forecast only: 2
20196 No exploit published6 High1 Medium4 Low1 not blocked6 No public exploit6 202013 Protected by Waratek5 No exploit published8 High5 Medium8 blocked by ARMR today5 not blocked8 No public exploit13 20216 Protected by Waratek1 No exploit published5 High1 Medium5 blocked by ARMR today1 not blocked5 No public exploit6 202229 Protected by Waratek1 No exploit published28 Critical2 High6 Medium21 blocked by ARMR today1 not blocked28 No public exploit29 202331 Protected by Waratek1 No exploit published30 High13 Medium16 Low2 blocked by ARMR today1 not blocked30 Forecast only1 No public exploit30 20246 No exploit published6 High2 Medium4 not blocked6 Forecast only1 No public exploit5 202519 No exploit published19 Critical1 High2 Medium14 Low2 not blocked19 No public exploit19 20267 No exploit published7 High1 Medium6 not blocked7 No public exploit7
20192020202120222023202420252026
117 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2020-2311 Medium 2020-11-04 No exploit published No public exploit A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration.
CVE-2020-2261 High 2020-09-16 Protected by Waratek No public exploit Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller
CVE-2020-2260 Medium 2020-09-16 No exploit published No public exploit A missing permission check in Jenkins Perfecto Plugin 1.17 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVE-2020-2212 Medium 2020-07-02 No exploit published No public exploit Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system or read permissions on the system configuration.
CVE-2020-2194 Medium 2020-06-03 No exploit published No public exploit Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2193 Medium 2020-06-03 No exploit published No public exploit Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2189 High 2020-05-06 Protected by Waratek No public exploit Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
CVE-2020-2180 High 2020-04-16 Protected by Waratek No public exploit Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
CVE-2020-2172 Medium 2020-04-07 Protected by Waratek No public exploit Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2020-2159 High 2020-03-09 Protected by Waratek No public exploit Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins.
CVE-2020-2106 Medium 2020-01-29 No exploit published No public exploit Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations.
CVE-2019-10447 Medium 2019-10-16 No exploit published No public exploit Jenkins Sofy.AI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVE-2019-10433 Low 2019-10-01 No exploit published No public exploit Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVE-2019-10430 Medium 2019-09-25 No exploit published No public exploit Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
CVE-2019-10326 Medium 2019-05-31 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds.
CVE-2019-1003023 Medium 2019-02-06 No exploit published No public exploit A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourcePrinter.java, src/main/java/io/jenkins/plugins/analysis/core/util/Sanitizer.java, src/main/java/io/jenkins/plugins/analysis/warnings/DuplicateCodeScanner.java that allows attackers with the ability to control warnings parser input to have Jenkins render arbitrary HTML.
CVE-2019-1003008 High 2019-02-06 No exploit published No public exploit A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.
‹ prev page 2 of 2 next ›