Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43478 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-2257 1 Jenkins 1 Validating String Parameter 2024-11-21 5.4 Medium
Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVE-2020-2256 1 Jenkins 1 Pipeline Maven Integration 2024-11-21 5.4 Medium
Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVE-2020-2248 1 Jenkins 1 Jsgames 2024-11-21 6.1 Medium
Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVE-2020-2246 1 Jenkins 1 Valgrind 2024-11-21 5.4 Medium
Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Valgrind XML report contents.
CVE-2020-2244 1 Jenkins 1 Build Failure Analyzer 2024-11-21 5.4 Medium
Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications.
CVE-2020-2243 1 Jenkins 1 Cadence Vmanager 2024-11-21 5.4 Medium
Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.
CVE-2020-2238 1 Jenkins 1 Git Parameter 2024-11-21 5.4 Medium
Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVE-2020-2236 1 Jenkins 1 Yet Another Build Visualizer 2024-11-21 5.4 Medium
Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Run/Update permission.
CVE-2020-2231 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 5.4 Medium
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.
CVE-2020-2230 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 5.4 Medium
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.
CVE-2020-2229 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 5.4 Medium
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
CVE-2020-2227 1 Jenkins 1 Deployer Framework 2024-11-21 5.4 Medium
Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2226 2 Jenkins, Redhat 2 Matrix Authorization Strategy, Openshift 2024-11-21 5.4 Medium
Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2225 2 Jenkins, Redhat 2 Matrix Project, Openshift 2024-11-21 5.4 Medium
Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2224 2 Jenkins, Redhat 2 Matrix Project, Openshift 2024-11-21 5.4 Medium
Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2223 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 5.4 Medium
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2222 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 5.4 Medium
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2221 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 5.4 Medium
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2220 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 5.4 Medium
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2219 1 Jenkins 1 Link Column 2024-11-21 5.4 Medium
Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stored cross-site scripting vulnerability.