Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2741▲ 14 respecto a la semana anterior

Críticas / altas1459▲ 324 respecto a la semana anterior

Nueva explotación activa (KEV)7▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)85▼ 441 respecto a la semana anterior

5 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2023-41944	Modificada	Media (6.1)	0.50%	—	Jenkins AWS Codecommit Trigger	6/9/2023	17/6/2026	Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability.
CVE-2023-41943	Modificada	Media (6.5)	0.64%	—	Jenkins AWS Codecommit Trigger	6/9/2023	17/6/2026	Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue.
CVE-2023-41942	Modificada	Media (4.3)	0.33%	—	Jenkins AWS Codecommit Trigger	6/9/2023	17/6/2026	A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue.
CVE-2023-41941	Modificada	Media (4.3)	0.45%	—	Jenkins AWS Codecommit Trigger	6/9/2023	17/6/2026	A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins.
CVE-2023-35147	Modificada	Media (6.5)	0.63%	—	Jenkins AWS Codecommit Trigger	14/6/2023	17/6/2026	Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system.