Overview 37 matches · 36 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
37matches
36in Waratek scope97.3%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
36
97.3%
Outside Waratek scope
0
0.0%
Not applicable
1
2.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
37
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
37
100.0%
split by
peak 12 / year
20142
No exploit published2
Medium2
not blocked2
No public exploit2
20150
20160
20175
No exploit published5
Critical1
High1
Medium3
not blocked5
No public exploit5
20185
No exploit published4
Not applicable1
High1
Medium4
not blocked5
No public exploit5
201912
No exploit published12
High5
Medium7
not blocked12
No public exploit12
20207
No exploit published7
High1
Medium6
not blocked7
No public exploit7
20211
No exploit published1
Medium1
not blocked1
No public exploit1
20225
No exploit published5
High1
Medium4
not blocked5
No public exploit5
201420152016201720182019202020212022
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2022-30972 | High | 2022-05-17 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e.g., archived artifacts) that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. |
| CVE-2022-30967 | Medium | 2022-05-17 | No exploit published | No public exploit | Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-28153 | Medium | 2022-03-29 | No exploit published | No public exploit | Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-28135 | Medium | 2022-03-29 | No exploit published | No public exploit | Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
| CVE-2022-27196 | Medium | 2022-03-15 | No exploit published | No public exploit | Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions. |
| CVE-2021-21634 | Medium | 2021-03-30 | No exploit published | No public exploit | Jenkins Jabber (XMPP) notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
| CVE-2020-2317 | Medium | 2020-11-04 | No exploit published | No public exploit | Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to Jenkins FindBugs Plugin's post build step. |
| CVE-2020-2316 | Medium | 2020-11-04 | No exploit published | No public exploit | Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2020-2280 | High | 2020-09-23 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Warnings Plugin 5.0.1 and earlier allows attackers to execute arbitrary code. |
| CVE-2020-2271 | Medium | 2020-09-16 | No exploit published | No public exploit | Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2020-2270 | Medium | 2020-09-16 | No exploit published | No public exploit | Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2020-2262 | Medium | 2020-09-16 | No exploit published | No public exploit | Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to the plugin's post-build step. |
| CVE-2020-2152 | Medium | 2020-03-09 | No exploit published | No public exploit | Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflected cross-site scripting vulnerability. |
| CVE-2019-10317 | Medium | 2019-04-30 | No exploit published | No public exploit | Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM. |
| CVE-2019-10308 | Medium | 2019-04-30 | No exploit published | No public exploit | A missing permission check in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers with Overall/Read permission to change the per-job default graph configuration for all users. |
| CVE-2019-10307 | Medium | 2019-04-30 | No exploit published | No public exploit | A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers to change the per-job default graph configuration for all users. |
| CVE-2019-1003066 | High | 2019-04-04 | No exploit published | No public exploit | Jenkins Bugzilla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. |
| CVE-2019-1003059 | Medium | 2019-04-04 | No exploit published | No public exploit | A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server. |
| CVE-2019-1003058 | Medium | 2019-04-04 | No exploit published | No public exploit | A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers to initiate a connection to an attacker-specified server. |
| CVE-2019-1003055 | High | 2019-04-04 | No exploit published | No public exploit | Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. |
| CVE-2019-1003051 | High | 2019-04-04 | No exploit published | No public exploit | Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. |
| CVE-2019-1003022 | Medium | 2019-02-06 | No exploit published | No public exploit | A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master. |
| CVE-2019-1003007 | High | 2019-02-06 | No exploit published | No public exploit | A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint. |
| CVE-2018-1000419 | Medium | 2019-01-09 | No exploit published | No public exploit | An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins. |
| CVE-2018-1000418 | High | 2019-01-09 | No exploit published | No public exploit | An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to send test notifications to an attacker-specified HipChat server with attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
| CVE-2018-1000202 | Medium | 2018-06-05 | Not applicable | No public exploit | A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions. |
| CVE-2018-1000147 | Medium | 2018-04-05 | No exploit published | No public exploit | An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with insufficient permission to obtain Perforce passwords configured in jobs to obtain them |
| CVE-2018-1000145 | Medium | 2018-04-05 | No exploit published | No public exploit | An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with local file system access to obtain encrypted Perforce passwords and decrypt them. |
| CVE-2017-1000403 | High | 2018-01-26 | No exploit published | No public exploit | Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM, effectively elevating privileges to Overall/Run Scripts. |
| CVE-2017-1000402 | Medium | 2018-01-26 | No exploit published | No public exploit | Jenkins Swarm Plugin Client 3.4 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. |
| CVE-2017-1000245 | Critical | 2017-11-01 | No exploit published | No public exploit | The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file. |
| CVE-2017-1000244 | High | 2017-11-01 | No exploit published | No public exploit | Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification |
| CVE-2017-1000243 | Medium | 2017-11-01 | No exploit published | No public exploit | Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites |
| CVE-2017-1000103 | Medium | 2017-10-05 | No exploit published | No public exploit | The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view. |
| CVE-2017-1000102 | Medium | 2017-10-05 | No exploit published | No public exploit | The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to these plugins, for example the console output which is parsed to extract build warnings (Warnings Plugin), could insert arbitrary HTML into this view. |
| CVE-2014-3679 | Medium | 2014-10-16 | No exploit published | No public exploit | The Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to obtain sensitive information by accessing unspecified pages. |
| CVE-2014-3678 | Medium | 2014-10-10 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |