WaratekVRT Sign in

High Git CVEs

14 CVEs, 1 exploited, 2 protected by Waratek

Reset
More filters (2)
Columns
Vendor org.jenkins-ci.plugins✕Product git✕
Overview 14 matches · 2 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
14matches 2protected14.3% 1exploited7.1% 0CISA KEV0.0% 2public PoC14.3% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 14.3% Rule in development 0 0.0% Mitigation candidate 1 7.1% No exploit published 11 78.6%
Critical 0 0.0% High 14 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 14.3% partly blocked 0 0.0% not blocked 12 85.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 7.1% Working exploit published 0 0.0% Proof of concept only 1 7.1% Forecast only 0 0.0% No public exploit 12 85.7%
split by peak 6 / year
No exploit published: 11Mitigation candidate: 1Protected by Waratek: 2 High: 14 not blocked: 12blocked by ARMR today: 2 No public exploit: 12Proof of concept only: 1Exploited: 1
20171 No exploit published1 High1 not blocked1 No public exploit1 20180 20196 Protected by Waratek1 No exploit published5 High6 blocked by ARMR today1 not blocked5 Proof of concept only1 No public exploit5 20202 No exploit published2 High2 not blocked2 No public exploit2 20210 20224 Protected by Waratek1 Mitigation candidate1 No exploit published2 High4 blocked by ARMR today1 not blocked3 Exploited1 No public exploit3 20230 20241 No exploit published1 High1 not blocked1 No public exploit1
20172018201920202021202220232024
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-28157 High 2024-03-06 No exploit published No public exploit Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
CVE-2022-36883 High 2022-07-27 Mitigation candidate Exploited A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
CVE-2022-36882 High 2022-07-27 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
CVE-2022-36881 High 2022-07-27 No exploit published No public exploit Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.
CVE-2022-30947 High 2022-05-17 Protected by Waratek No public exploit Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
CVE-2020-2228 High 2020-07-15 No exploit published No public exploit Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability.
CVE-2020-2116 High 2020-02-12 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-10392 High 2019-09-12 Protected by Waratek Proof of concept only Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.
CVE-2019-10371 High 2019-08-07 No exploit published No public exploit A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
CVE-2019-10330 High 2019-05-31 No exploit published No public exploit Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.
CVE-2019-10315 High 2019-04-30 No exploit published No public exploit Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.
CVE-2019-10301 High 2019-04-18 No exploit published No public exploit A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-10300 High 2019-04-18 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2017-1000092 High 2017-10-05 No exploit published No public exploit Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.