CVE Intelligence
Home / CVEs

Exploited vulnerabilities (CISA KEV)

CVEs with exploitation confirmed by CISA (Known Exploited Vulnerabilities), with required actions and deadlines.

Severity
Clear

7 result(s)

Export this search: RSS · CSV · STIX
CVE-2024-23897 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Jan 24, 2024
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
CVE-2023-44487 High · 7.5 KEV Urgent · 73 Public exploit CWE-400 Oct 10, 2023
HTTP/2 Rapid Reset Attack Vulnerability
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2019-1003030 Critical · 9.9 KEV Urgent · 78 Public exploit CWE-693 Mar 8, 2019
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
CVE-2019-1003029 Critical · 9.9 KEV Urgent · 72 Public exploit Mar 8, 2019
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
CVE-2018-1000861 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-502 Dec 10, 2018
Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
CVE-2017-1000353 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-502 Jan 29, 2018
Jenkins Remote Code Execution Vulnerability
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
CVE-2015-5317 High · 7.5 KEV High · 59 CWE-200 Nov 25, 2015
Jenkins User Interface (UI) Information Disclosure Vulnerability
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.