WaratekVRT Sign in
Reset
More filters (2)
Columns
Vendor org.jenkins-ci.plugins✕Has a public PoC✕
Overview 10 matches · 2 protected · 4 exploited · 1 CISA KEV · 5 EPSS ≥ 0.5
10matches 2protected20.0% 4exploited40.0% 1CISA KEV10.0% 5EPSS ≥ 0.550.0%
Protected by Waratek 2 20.0% Rule in development 0 0.0% Mitigation candidate 8 80.0% No exploit published 0 0.0%
Critical 1 10.0% High 6 60.0% Medium 3 30.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 20.0% partly blocked 0 0.0% not blocked 8 80.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 40.0% Working exploit published 5 50.0% Proof of concept only 1 10.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 6 / year
Mitigation candidate: 8Protected by Waratek: 2 Medium: 3High: 6Critical: 1 not blocked: 8blocked by ARMR today: 2 Proof of concept only: 1Working exploit published: 5Exploited: 4
20131 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20140 20150 20160 20170 20181 Mitigation candidate1 High1 not blocked1 Working exploit published1 20196 Protected by Waratek2 Mitigation candidate4 Critical1 High4 Medium1 blocked by ARMR today2 not blocked4 Exploited3 Working exploit published2 Proof of concept only1 20201 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20210 20221 Mitigation candidate1 High1 not blocked1 Exploited1
2013201420152016201720182019202020212022
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-36883 High 2022-07-27 Mitigation candidate Exploited A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
CVE-2020-2140 Medium 2020-03-09 Mitigation candidate Working exploit published Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
CVE-2019-10475 Medium 2019-10-23 Mitigation candidate Working exploit published A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
CVE-2019-10392 High 2019-09-12 Protected by Waratek Proof of concept only Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.
CVE-2019-1003029 Critical 2019-03-08 Protected by Waratek Exploited A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
CVE-2019-1003005 High 2019-02-06 Mitigation candidate Working exploit published A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
CVE-2019-1003001 High 2019-01-22 Mitigation candidate Exploited A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
CVE-2019-1003000 High 2019-01-22 Mitigation candidate Exploited A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
CVE-2018-8718 High 2018-03-27 Mitigation candidate Working exploit published Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.
CVE-2013-5676 Medium 2013-12-13 Mitigation candidate Working exploit published The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.