SS
Product
Script Security
On CISA KEVExploited in the wild
45
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 8High 25Medium 12Low 0
Watch
Add Script Security to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-1000505 | 6.5 | Jan 25 | In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to… Affected: through 1.36 |
| CVE-2017-1000095 | 6.5 | Oct 5 | The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String) Affected: 1.34 |
| CVE-2020-2190 | 5.4 | Jun 3 | Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored… Affected: through 1.72 |
| CVE-2026-84659 | 4.3 | Sep 2 | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the… Affected: through 1412.v7737b_3405f86 |
| CVE-2026-84658 | 4.3 | Sep 2 | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing… Affected: through 1412.v7737b_3405f86 |
| CVE-2026-42519 | 4.3 | Apr 29 | A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script… Affected: through 1399.ve6a_66547f6e1 |
| CVE-2024-52549 | 4.3 | Nov 13 | Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method… Affected: before 1362.1364.v4cf2dc5d8776; 1366.vd44b_49a_5c85c before 1367.vdf2fc45f229c; 1365.v4778ca_84b_de5 |
| CVE-2022-30946 | 4.3 | May 17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an… Affected: before 1172.v35f6a_0b_8207e |
| CVE-2019-10400 | 4.2 | Sep 12 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement expressions not involving… Affected: through 1.62 |
| CVE-2019-10399 | 4.2 | Sep 12 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in increment and decrement… Affected: through 1.62 |
| CVE-2019-10394 | 4.2 | Sep 12 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions on the left-hand side of… Affected: through 1.62 |
| CVE-2019-10393 | 4.2 | Sep 12 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute… Affected: through 1.62 |
Showing 12