Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2624▼ 224 respecto a la semana anterior

Críticas / altas1373▲ 143 respecto a la semana anterior

Nueva explotación activa (KEV)7▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)81▼ 449 respecto a la semana anterior

6 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2023-49673	Modificada	Alta (8.8)	0.45%	—	Jenkins Neuvector Vulnerability Scanner Jenkins Jira Jenkins Google Compute Engine Jenkins Matlab	29/11/2023	17/6/2026	A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.
CVE-2023-49652	Modificada	Baja (2.7)	0.53%	—	Jenkins Google Compute Engine	29/11/2023	17/6/2026	Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs of credentials stored in Jenkins and to connect to…
CVE-2022-29052	Modificada	Media (4.3)	0.75%	—	Jenkins Google Compute Engine	12/4/2022	17/6/2026	Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVE-2019-16548	Modificada	Alta (8.8)	0.69%	—	Jenkins Google Compute Engine	21/11/2019	17/6/2026	A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents.
CVE-2019-16547	Modificada	Media (4.3)	0.69%	—	Jenkins Google Compute Engine	21/11/2019	17/6/2026	Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment.
CVE-2019-16546	Modificada	Media (5.9)	0.87%	—	Jenkins Google Compute Engine	21/11/2019	17/6/2026	Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.