Overview 8 matches · 7 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
8matches
7in Waratek scope87.5%
1protected12.5%
0exploited0.0%
0CISA KEV0.0%
1public PoC12.5%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
12.5%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
6
75.0%
Outside Waratek scope
0
0.0%
Not applicable
1
12.5%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
12.5%
partly blocked
0
0.0%
not blocked
7
87.5%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
1
12.5%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
7
87.5%
split by
peak 4 / year
20121
Not applicable1
Medium1
not blocked1
Working exploit published1
20130
20140
20150
20160
20170
20180
20190
20204
Protected by Waratek1
No exploit published3
Medium4
blocked by ARMR today1
not blocked3
No public exploit4
20210
20222
No exploit published2
Medium2
not blocked2
No public exploit2
20231
No exploit published1
Medium1
not blocked1
No public exploit1
201220132014201520162017201820192020202120222023
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-24442 | Medium | 2023-01-26 | No exploit published | No public exploit | Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
| CVE-2022-43424 | Medium | 2022-10-19 | No exploit published | No public exploit | Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process. |
| CVE-2022-36897 | Medium | 2022-07-27 | No exploit published | No public exploit | A missing permission check in Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. |
| CVE-2020-2265 | Medium | 2020-09-16 | No exploit published | No public exploit | Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not escape the method information in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to the plugin's post-build step. |
| CVE-2020-2212 | Medium | 2020-07-02 | No exploit published | No public exploit | Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system or read permissions on the system configuration. |
| CVE-2020-2172 | Medium | 2020-04-07 | Protected by Waratek | No public exploit | Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2020-2106 | Medium | 2020-01-29 | No exploit published | No public exploit | Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations. |
| CVE-2011-4280 | Medium | 2012-07-16 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |