CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 20/09/2023 |
| CVE-2023-43499 | 보통5.4 | Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes. | 20/09/2023 |
| CVE-2020-2244 | 보통5.4 | Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications. | 01/09/2020 |
| CVE-2019-16555 | 보통6.5 | A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process. | 17/12/2019 |
| CVE-2019-16554 | 보통4.3 | A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression. | 17/12/2019 |
| CVE-2019-16553 | 높음8.8 | A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression. | 17/12/2019 |
| CVE-2016-4988 | 보통6.1 | Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. | 09/02/2017 |
| CVE-2013-6374 | 낮음3.5 | Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. | 25/11/2013 |