Overview 23 matches · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 1 EPSS ≥ 0.5
Protected by Waratek
2
8.7%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
21
91.3%
blocked by ARMR today
2
8.7%
partly blocked
0
0.0%
not blocked
21
91.3%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
1
4.3%
No public exploit
22
95.7%
split by
peak 8 / quarter
Q4 171
No exploit published1
Medium1
not blocked1
No public exploit1
Q1 180
Q2 180
Q3 180
Q4 180
Q1 190
Q2 190
Q3 190
Q4 190
Q1 205
No exploit published5
Medium5
not blocked5
No public exploit5
Q2 201
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
Q3 204
No exploit published4
Medium4
not blocked4
No public exploit4
Q4 200
Q1 214
No exploit published4
High1
Medium3
not blocked4
Forecast only1
No public exploit3
Q2 210
Q3 210
Q4 210
Q1 228
Protected by Waratek1
No exploit published7
High1
Medium7
blocked by ARMR today1
not blocked7
No public exploit8
Q1 18Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2022-27212 | Medium | 2022-03-15 | No exploit published | No public exploit | Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-27205 | Medium | 2022-03-15 | No exploit published | No public exploit | A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
| CVE-2022-27204 | High | 2022-03-15 | No exploit published | No public exploit | A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers to connect to an attacker-specified URL. |
| CVE-2022-27203 | Medium | 2022-03-15 | Protected by Waratek | No public exploit | Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller. |
| CVE-2022-27202 | Medium | 2022-03-15 | No exploit published | No public exploit | Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-27195 | Medium | 2022-03-15 | No exploit published | No public exploit | Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system. |
| CVE-2022-25191 | Medium | 2022-02-15 | No exploit published | No public exploit | Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-25189 | Medium | 2022-02-15 | No exploit published | No public exploit | Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2021-21635 | Medium | 2021-03-30 | No exploit published | No public exploit | Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2021-21629 | High | 2021-03-30 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a project with attacker-specified parameters. |
| CVE-2021-21628 | Medium | 2021-03-30 | No exploit published | Forecast only | Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2021-21622 | Medium | 2021-02-24 | No exploit published | No public exploit | Jenkins Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2020-2257 | Medium | 2020-09-16 | No exploit published | No public exploit | Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2020-2239 | Medium | 2020-09-01 | No exploit published | No public exploit | Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system. |
| CVE-2020-2238 | Medium | 2020-09-01 | No exploit published | No public exploit | Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2020-2210 | Medium | 2020-07-02 | No exploit published | No public exploit | Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure. |
| CVE-2020-2178 | High | 2020-04-16 | Protected by Waratek | No public exploit | Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2020-2132 | Medium | 2020-02-12 | No exploit published | No public exploit | Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system. |
| CVE-2020-2124 | Medium | 2020-02-12 | No exploit published | No public exploit | Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system. |
| CVE-2020-2113 | Medium | 2020-02-12 | No exploit published | No public exploit | Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission. |
| CVE-2020-2112 | Medium | 2020-02-12 | No exploit published | No public exploit | Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission. |
| CVE-2020-1928 | Medium | 2020-01-28 | No exploit published | No public exploit | An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present. |
| CVE-2017-1000084 | Medium | 2017-10-05 | No exploit published | No public exploit | Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins. |