Search criteria ⓘ Use full-text search for keyword queries.
Combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by dates instead of relevance.

519 vulnerabilities found for jenkins by jenkins

CVE-2026-33002 (GCVE-0-2026-33002)

Vulnerability from nvd – Published: 2026-03-18 15:15 – Updated: 2026-03-19 14:45
VLAI?
Summary
Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.
Severity ?
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-350 - Reliance on Reverse DNS Resolution for a Security-Critical Action
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 0 , < 2.426.3 (maven)
Unaffected: 2.427 , < 2.442 (maven)
Unaffected: 2.555 , < * (maven)
Unaffected: 2.541.3 , < 2.541.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-33002",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-19T14:43:30.815362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-350",
                "description": "CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-19T14:45:46.878Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "2.426.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.442",
              "status": "unaffected",
              "version": "2.427",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.555",
              "versionType": "maven"
            },
            {
              "lessThan": "2.541.*",
              "status": "unaffected",
              "version": "2.541.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-18T15:15:25.002Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-03-18",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3674"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-33002",
    "datePublished": "2026-03-18T15:15:25.002Z",
    "dateReserved": "2026-03-17T15:04:07.616Z",
    "dateUpdated": "2026-03-19T14:45:46.878Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33001 (GCVE-0-2026-33001)

Vulnerability from nvd – Published: 2026-03-18 15:15 – Updated: 2026-03-19 12:58
VLAI?
Summary
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.555 , < * (maven)
Unaffected: 2.541.3 , < 2.541.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-33001",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-19T03:55:23.659873Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-59",
                "description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-19T12:58:23.233Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.555",
              "versionType": "maven"
            },
            {
              "lessThan": "2.541.*",
              "status": "unaffected",
              "version": "2.541.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins.\nThis can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-18T15:15:23.950Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-03-18",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-33001",
    "datePublished": "2026-03-18T15:15:23.950Z",
    "dateReserved": "2026-03-17T15:04:07.615Z",
    "dateUpdated": "2026-03-19T12:58:23.233Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27100 (GCVE-0-2026-27100)

Vulnerability from nvd – Published: 2026-02-18 14:17 – Updated: 2026-02-18 14:53
VLAI?
Summary
Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.551 , < * (maven)
Unaffected: 2.541.2 , < 2.541.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-27100",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-18T14:50:38.503514Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-18T14:53:33.264Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.551",
              "versionType": "maven"
            },
            {
              "lessThan": "2.541.*",
              "status": "unaffected",
              "version": "2.541.2",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-18T14:17:44.672Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-02-18",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-02-18/#SECURITY-3658"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-27100",
    "datePublished": "2026-02-18T14:17:44.672Z",
    "dateReserved": "2026-02-17T16:48:49.373Z",
    "dateUpdated": "2026-02-18T14:53:33.264Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27099 (GCVE-0-2026-27099)

Vulnerability from nvd – Published: 2026-02-18 14:17 – Updated: 2026-02-18 14:56
VLAI?
Summary
Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.
Severity ?
8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 0 , < 2.483 (maven)
Unaffected: 2.551 , < * (maven)
Unaffected: 2.541.2 , < 2.541.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-27099",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-18T14:55:42.504808Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-18T14:56:27.973Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "2.483",
              "status": "unaffected",
              "version": "0",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.551",
              "versionType": "maven"
            },
            {
              "lessThan": "2.541.*",
              "status": "unaffected",
              "version": "2.541.2",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the \"Mark temporarily offline\" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-18T14:17:43.911Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-02-18",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-02-18/#SECURITY-3669"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-27099",
    "datePublished": "2026-02-18T14:17:43.911Z",
    "dateReserved": "2026-02-17T16:48:49.373Z",
    "dateUpdated": "2026-02-18T14:56:27.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67639 (GCVE-0-2025-67639)

Vulnerability from nvd – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:27
VLAI?
Summary
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.
Severity ?
3.5 (Low)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.541 , < * (maven)
Unaffected: 2.528.3 , < 2.528.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.5,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67639",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:27:23.050997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-352",
                "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:27:25.419Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker\u0027s account."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:38.218Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1166"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67639",
    "datePublished": "2025-12-10T16:50:38.218Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-10T17:27:25.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67638 (GCVE-0-2025-67638)

Vulnerability from nvd – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:33
VLAI?
Summary
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-312 - Cleartext Storage of Sensitive Information
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.541 , < * (maven)
Unaffected: 2.528.3 , < 2.528.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67638",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:33:12.151344Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-312",
                "description": "CWE-312 Cleartext Storage of Sensitive Information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:33:14.791Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:37.570Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67638",
    "datePublished": "2025-12-10T16:50:37.570Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-10T17:33:14.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67637 (GCVE-0-2025-67637)

Vulnerability from nvd – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:33
VLAI?
Summary
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-312 - Cleartext Storage of Sensitive Information
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.541 , < * (maven)
Unaffected: 2.528.3 , < 2.528.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67637",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:33:28.070858Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-312",
                "description": "CWE-312 Cleartext Storage of Sensitive Information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:33:30.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:36.942Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67637",
    "datePublished": "2025-12-10T16:50:36.942Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-10T17:33:30.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67636 (GCVE-0-2025-67636)

Vulnerability from nvd – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:36
VLAI?
Summary
A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.541 , < * (maven)
Unaffected: 2.528.3 , < 2.528.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67636",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:36:48.563369Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:36:51.043Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:36.239Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1809"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67636",
    "datePublished": "2025-12-10T16:50:36.239Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-10T17:36:51.043Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67635 (GCVE-0-2025-67635)

Vulnerability from nvd – Published: 2025-12-10 16:50 – Updated: 2025-12-16 13:36
VLAI?
Summary
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
Severity ?
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-404 - Improper Resource Shutdown or Release
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.541 , < * (maven)
Unaffected: 2.528.3 , < 2.528.* (maven)
Create a notification for this product.
Credits
Camilo Vera Vidales (https://www.linkedin.com/in/camilo-vera-vidales/)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67635",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:33:51.868670Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-404",
                "description": "CWE-404 Improper Resource Shutdown or Release",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:35:17.788Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Camilo Vera Vidales (https://www.linkedin.com/in/camilo-vera-vidales/)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-16T13:36:56.086Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3630"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67635",
    "datePublished": "2025-12-10T16:50:35.491Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-16T13:36:56.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-59476 (GCVE-0-2025-59476)

Vulnerability from nvd – Published: 2025-09-17 13:17 – Updated: 2025-11-04 21:13
VLAI?
Summary
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • CWE-117 - Improper Output Neutralization for Logs
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.516.3 , < 2.516.* (maven)
Unaffected: 2.528 , < * (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-59476",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-25T18:37:10.453425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-117",
                "description": "CWE-117 Improper Output Neutralization for Logs",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-25T18:37:37.848Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:13:53.735Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/17/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "2.516.*",
              "status": "unaffected",
              "version": "2.516.3",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.528",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-17T13:17:48.559Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-09-17",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-09-17/#SECURITY-3424"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-59476",
    "datePublished": "2025-09-17T13:17:48.559Z",
    "dateReserved": "2025-09-16T16:16:05.526Z",
    "dateUpdated": "2025-11-04T21:13:53.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-59475 (GCVE-0-2025-59475)

Vulnerability from nvd – Published: 2025-09-17 13:17 – Updated: 2025-11-04 21:13
VLAI?
Summary
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.516.3 , < 2.516.* (maven)
Unaffected: 2.528 , < * (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-59475",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-25T18:39:47.958376Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-25T18:39:53.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:13:52.430Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/17/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "2.516.*",
              "status": "unaffected",
              "version": "2.516.3",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.528",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-17T13:17:47.879Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-09-17",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-09-17/#SECURITY-3625"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-59475",
    "datePublished": "2025-09-17T13:17:47.879Z",
    "dateReserved": "2025-09-16T16:16:05.525Z",
    "dateUpdated": "2025-11-04T21:13:52.430Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-59474 (GCVE-0-2025-59474)

Vulnerability from nvd – Published: 2025-09-17 13:17 – Updated: 2025-11-04 21:13
VLAI?
Summary
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 0 , < 2.387 (maven)
Unaffected: 2.516.3 , < 2.516.* (maven)
Unaffected: 2.528 , < * (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-59474",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-25T18:41:24.213055Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-25T18:41:28.195Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:13:51.125Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/17/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "2.387",
              "status": "unaffected",
              "version": "0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.516.*",
              "status": "unaffected",
              "version": "2.516.3",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.528",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-17T13:17:47.174Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-09-17",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-09-17/#SECURITY-3594"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-59474",
    "datePublished": "2025-09-17T13:17:47.174Z",
    "dateReserved": "2025-09-16T16:16:05.525Z",
    "dateUpdated": "2025-11-04T21:13:51.125Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-9453 (GCVE-0-2024-9453)

Vulnerability from nvd – Published: 2025-07-04 08:36 – Updated: 2025-12-12 13:46
VLAI?
Title
Jenkins-image: sensitive data disclosure when using openshift jenkins image
Summary
A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if they have access to sensitive information.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
Impacted products
Vendor Product Version
Jenkins openshift-sync-plugin Affected: 0 , < 1.1.0.818.v3883b_3b_df89a_ (custom)
Create a notification for this product.
Date Public ?
2025-07-04 08:31
Credits
Red Hat would like to thank Aino de Vries for reporting this issue.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9453",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-08T14:19:32.775749Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-08T14:19:40.791Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/jenkinsci/openshift-sync-plugin",
          "defaultStatus": "unaffected",
          "packageName": "openshift-sync-plugin",
          "product": "openshift-sync-plugin",
          "vendor": "Jenkins",
          "versions": [
            {
              "lessThan": "1.1.0.818.v3883b_3b_df89a_",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ocp_tools"
          ],
          "defaultStatus": "affected",
          "packageName": "jenkins",
          "product": "OpenShift Developer Tools and Services",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Aino de Vries for reporting this issue."
        }
      ],
      "datePublic": "2025-07-04T08:31:29.662Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if they have access to sensitive information."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-12T13:46:49.566Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-9453"
        },
        {
          "name": "RHBZ#2316231",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316231"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-10-03T00:21:04.654Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-07-04T08:31:29.662Z",
          "value": "Made public."
        }
      ],
      "title": "Jenkins-image: sensitive data disclosure when using openshift jenkins image",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-532: Insertion of Sensitive Information into Log File"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-9453",
    "datePublished": "2025-07-04T08:36:35.184Z",
    "dateReserved": "2024-10-03T00:24:06.523Z",
    "dateUpdated": "2025-12-12T13:46:49.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-31721 (GCVE-0-2025-31721)

Vulnerability from nvd – Published: 2025-04-02 14:59 – Updated: 2025-04-02 16:51
VLAI?
Summary
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.492.3 , < 2.492.* (maven)
Unaffected: 2.504 , < * (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-31721",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-02T16:49:39.367838Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-02T16:51:08.706Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "2.492.*",
              "status": "unaffected",
              "version": "2.492.3",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.504",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-02T14:59:50.144Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-04-02",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3513"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-31721",
    "datePublished": "2025-04-02T14:59:50.144Z",
    "dateReserved": "2025-04-01T12:50:10.765Z",
    "dateUpdated": "2025-04-02T16:51:08.706Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-31720 (GCVE-0-2025-31720)

Vulnerability from nvd – Published: 2025-04-02 14:59 – Updated: 2025-04-02 16:49
VLAI?
Summary
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.492.3 , < 2.492.* (maven)
Unaffected: 2.504 , < * (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-31720",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-02T16:49:16.249111Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-02T16:49:21.599Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "2.492.*",
              "status": "unaffected",
              "version": "2.492.3",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.504",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-02T14:59:49.570Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-04-02",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3512"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-31720",
    "datePublished": "2025-04-02T14:59:49.570Z",
    "dateReserved": "2025-04-01T12:50:10.765Z",
    "dateUpdated": "2025-04-02T16:49:21.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-33002 (GCVE-0-2026-33002)

Vulnerability from cvelistv5 – Published: 2026-03-18 15:15 – Updated: 2026-03-19 14:45
VLAI?
Summary
Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.
Severity ?
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-350 - Reliance on Reverse DNS Resolution for a Security-Critical Action
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 0 , < 2.426.3 (maven)
Unaffected: 2.427 , < 2.442 (maven)
Unaffected: 2.555 , < * (maven)
Unaffected: 2.541.3 , < 2.541.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-33002",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-19T14:43:30.815362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-350",
                "description": "CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-19T14:45:46.878Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "2.426.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.442",
              "status": "unaffected",
              "version": "2.427",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.555",
              "versionType": "maven"
            },
            {
              "lessThan": "2.541.*",
              "status": "unaffected",
              "version": "2.541.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-18T15:15:25.002Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-03-18",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3674"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-33002",
    "datePublished": "2026-03-18T15:15:25.002Z",
    "dateReserved": "2026-03-17T15:04:07.616Z",
    "dateUpdated": "2026-03-19T14:45:46.878Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33001 (GCVE-0-2026-33001)

Vulnerability from cvelistv5 – Published: 2026-03-18 15:15 – Updated: 2026-03-19 12:58
VLAI?
Summary
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.555 , < * (maven)
Unaffected: 2.541.3 , < 2.541.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-33001",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-19T03:55:23.659873Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-59",
                "description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-19T12:58:23.233Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.555",
              "versionType": "maven"
            },
            {
              "lessThan": "2.541.*",
              "status": "unaffected",
              "version": "2.541.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins.\nThis can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-18T15:15:23.950Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-03-18",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-33001",
    "datePublished": "2026-03-18T15:15:23.950Z",
    "dateReserved": "2026-03-17T15:04:07.615Z",
    "dateUpdated": "2026-03-19T12:58:23.233Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27100 (GCVE-0-2026-27100)

Vulnerability from cvelistv5 – Published: 2026-02-18 14:17 – Updated: 2026-02-18 14:53
VLAI?
Summary
Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.551 , < * (maven)
Unaffected: 2.541.2 , < 2.541.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-27100",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-18T14:50:38.503514Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-18T14:53:33.264Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.551",
              "versionType": "maven"
            },
            {
              "lessThan": "2.541.*",
              "status": "unaffected",
              "version": "2.541.2",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-18T14:17:44.672Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-02-18",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-02-18/#SECURITY-3658"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-27100",
    "datePublished": "2026-02-18T14:17:44.672Z",
    "dateReserved": "2026-02-17T16:48:49.373Z",
    "dateUpdated": "2026-02-18T14:53:33.264Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27099 (GCVE-0-2026-27099)

Vulnerability from cvelistv5 – Published: 2026-02-18 14:17 – Updated: 2026-02-18 14:56
VLAI?
Summary
Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.
Severity ?
8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 0 , < 2.483 (maven)
Unaffected: 2.551 , < * (maven)
Unaffected: 2.541.2 , < 2.541.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-27099",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-18T14:55:42.504808Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-18T14:56:27.973Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "2.483",
              "status": "unaffected",
              "version": "0",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.551",
              "versionType": "maven"
            },
            {
              "lessThan": "2.541.*",
              "status": "unaffected",
              "version": "2.541.2",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the \"Mark temporarily offline\" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-18T14:17:43.911Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-02-18",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-02-18/#SECURITY-3669"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-27099",
    "datePublished": "2026-02-18T14:17:43.911Z",
    "dateReserved": "2026-02-17T16:48:49.373Z",
    "dateUpdated": "2026-02-18T14:56:27.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67639 (GCVE-0-2025-67639)

Vulnerability from cvelistv5 – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:27
VLAI?
Summary
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.
Severity ?
3.5 (Low)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.541 , < * (maven)
Unaffected: 2.528.3 , < 2.528.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.5,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67639",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:27:23.050997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-352",
                "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:27:25.419Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker\u0027s account."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:38.218Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1166"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67639",
    "datePublished": "2025-12-10T16:50:38.218Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-10T17:27:25.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67638 (GCVE-0-2025-67638)

Vulnerability from cvelistv5 – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:33
VLAI?
Summary
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-312 - Cleartext Storage of Sensitive Information
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.541 , < * (maven)
Unaffected: 2.528.3 , < 2.528.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67638",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:33:12.151344Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-312",
                "description": "CWE-312 Cleartext Storage of Sensitive Information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:33:14.791Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:37.570Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67638",
    "datePublished": "2025-12-10T16:50:37.570Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-10T17:33:14.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67637 (GCVE-0-2025-67637)

Vulnerability from cvelistv5 – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:33
VLAI?
Summary
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-312 - Cleartext Storage of Sensitive Information
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.541 , < * (maven)
Unaffected: 2.528.3 , < 2.528.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67637",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:33:28.070858Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-312",
                "description": "CWE-312 Cleartext Storage of Sensitive Information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:33:30.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:36.942Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67637",
    "datePublished": "2025-12-10T16:50:36.942Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-10T17:33:30.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67636 (GCVE-0-2025-67636)

Vulnerability from cvelistv5 – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:36
VLAI?
Summary
A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.541 , < * (maven)
Unaffected: 2.528.3 , < 2.528.* (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67636",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:36:48.563369Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:36:51.043Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:36.239Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1809"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67636",
    "datePublished": "2025-12-10T16:50:36.239Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-10T17:36:51.043Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67635 (GCVE-0-2025-67635)

Vulnerability from cvelistv5 – Published: 2025-12-10 16:50 – Updated: 2025-12-16 13:36
VLAI?
Summary
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
Severity ?
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-404 - Improper Resource Shutdown or Release
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.541 , < * (maven)
Unaffected: 2.528.3 , < 2.528.* (maven)
Create a notification for this product.
Credits
Camilo Vera Vidales (https://www.linkedin.com/in/camilo-vera-vidales/)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67635",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:33:51.868670Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-404",
                "description": "CWE-404 Improper Resource Shutdown or Release",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:35:17.788Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Camilo Vera Vidales (https://www.linkedin.com/in/camilo-vera-vidales/)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-16T13:36:56.086Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3630"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67635",
    "datePublished": "2025-12-10T16:50:35.491Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-16T13:36:56.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-59476 (GCVE-0-2025-59476)

Vulnerability from cvelistv5 – Published: 2025-09-17 13:17 – Updated: 2025-11-04 21:13
VLAI?
Summary
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • CWE-117 - Improper Output Neutralization for Logs
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.516.3 , < 2.516.* (maven)
Unaffected: 2.528 , < * (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-59476",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-25T18:37:10.453425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-117",
                "description": "CWE-117 Improper Output Neutralization for Logs",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-25T18:37:37.848Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:13:53.735Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/17/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "2.516.*",
              "status": "unaffected",
              "version": "2.516.3",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.528",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-17T13:17:48.559Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-09-17",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-09-17/#SECURITY-3424"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-59476",
    "datePublished": "2025-09-17T13:17:48.559Z",
    "dateReserved": "2025-09-16T16:16:05.526Z",
    "dateUpdated": "2025-11-04T21:13:53.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-59475 (GCVE-0-2025-59475)

Vulnerability from cvelistv5 – Published: 2025-09-17 13:17 – Updated: 2025-11-04 21:13
VLAI?
Summary
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.516.3 , < 2.516.* (maven)
Unaffected: 2.528 , < * (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-59475",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-25T18:39:47.958376Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-25T18:39:53.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:13:52.430Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/17/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "2.516.*",
              "status": "unaffected",
              "version": "2.516.3",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.528",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-17T13:17:47.879Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-09-17",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-09-17/#SECURITY-3625"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-59475",
    "datePublished": "2025-09-17T13:17:47.879Z",
    "dateReserved": "2025-09-16T16:16:05.525Z",
    "dateUpdated": "2025-11-04T21:13:52.430Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-59474 (GCVE-0-2025-59474)

Vulnerability from cvelistv5 – Published: 2025-09-17 13:17 – Updated: 2025-11-04 21:13
VLAI?
Summary
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 0 , < 2.387 (maven)
Unaffected: 2.516.3 , < 2.516.* (maven)
Unaffected: 2.528 , < * (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-59474",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-25T18:41:24.213055Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-25T18:41:28.195Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:13:51.125Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/17/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "2.387",
              "status": "unaffected",
              "version": "0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.516.*",
              "status": "unaffected",
              "version": "2.516.3",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.528",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-17T13:17:47.174Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-09-17",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-09-17/#SECURITY-3594"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-59474",
    "datePublished": "2025-09-17T13:17:47.174Z",
    "dateReserved": "2025-09-16T16:16:05.525Z",
    "dateUpdated": "2025-11-04T21:13:51.125Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-9453 (GCVE-0-2024-9453)

Vulnerability from cvelistv5 – Published: 2025-07-04 08:36 – Updated: 2025-12-12 13:46
VLAI?
Title
Jenkins-image: sensitive data disclosure when using openshift jenkins image
Summary
A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if they have access to sensitive information.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
Impacted products
Vendor Product Version
Jenkins openshift-sync-plugin Affected: 0 , < 1.1.0.818.v3883b_3b_df89a_ (custom)
Create a notification for this product.
Date Public ?
2025-07-04 08:31
Credits
Red Hat would like to thank Aino de Vries for reporting this issue.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9453",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-08T14:19:32.775749Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-08T14:19:40.791Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/jenkinsci/openshift-sync-plugin",
          "defaultStatus": "unaffected",
          "packageName": "openshift-sync-plugin",
          "product": "openshift-sync-plugin",
          "vendor": "Jenkins",
          "versions": [
            {
              "lessThan": "1.1.0.818.v3883b_3b_df89a_",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ocp_tools"
          ],
          "defaultStatus": "affected",
          "packageName": "jenkins",
          "product": "OpenShift Developer Tools and Services",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Aino de Vries for reporting this issue."
        }
      ],
      "datePublic": "2025-07-04T08:31:29.662Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if they have access to sensitive information."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-12T13:46:49.566Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-9453"
        },
        {
          "name": "RHBZ#2316231",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2316231"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-10-03T00:21:04.654Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-07-04T08:31:29.662Z",
          "value": "Made public."
        }
      ],
      "title": "Jenkins-image: sensitive data disclosure when using openshift jenkins image",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-532: Insertion of Sensitive Information into Log File"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-9453",
    "datePublished": "2025-07-04T08:36:35.184Z",
    "dateReserved": "2024-10-03T00:24:06.523Z",
    "dateUpdated": "2025-12-12T13:46:49.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-31721 (GCVE-0-2025-31721)

Vulnerability from cvelistv5 – Published: 2025-04-02 14:59 – Updated: 2025-04-02 16:51
VLAI?
Summary
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
Jenkins Project Jenkins Unaffected: 2.492.3 , < 2.492.* (maven)
Unaffected: 2.504 , < * (maven)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-31721",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-02T16:49:39.367838Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-02T16:51:08.706Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "2.492.*",
              "status": "unaffected",
              "version": "2.492.3",
              "versionType": "maven"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.504",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-02T14:59:50.144Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-04-02",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3513"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-31721",
    "datePublished": "2025-04-02T14:59:50.144Z",
    "dateReserved": "2025-04-01T12:50:10.765Z",
    "dateUpdated": "2025-04-02T16:51:08.706Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

VAR-202310-0175

Vulnerability from variot - Updated: 2026-03-09 20:20

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

The purpose of this text-only errata is to inform you about the security issues fixed. See references for release notes.

Description:

This asynchronous patch is a security update zip for the JBoss EAP XP 4.0.0 runtime distribution for use with EAP 7.4.13.

Description:

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_7610.json

Red Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

  • Packet Storm Staff

==================================================================== Red Hat Security Advisory

Synopsis: Important: OpenShift Container Platform 4.12.45 packages and security update Advisory ID: RHSA-2023:7610-03 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2023:7610 Issue date: 2023-12-06 Revision: 03 CVE Names: CVE-2023-44487 ====================================================================

Summary:

Red Hat OpenShift Container Platform release 4.12.45 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 4.12.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.45. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHSA-2023:7608

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

  • python-werkzeug: high resource consumption leading to denial of service (CVE-2023-46136)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

Solution:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

CVEs:

CVE-2023-44487

References:

https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/RHSB-2023-003 https://bugzilla.redhat.com/show_bug.cgi?id=2242803 https://bugzilla.redhat.com/show_bug.cgi?id=2243296 https://bugzilla.redhat.com/show_bug.cgi?id=2246310

. ========================================================================== Ubuntu Security Notice USN-6427-2 October 19, 2023

dotnet8 vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 23.10

Summary:

.NET could be made to crash if it received specially crafted network traffic.

Software Description: - dotnet8: .NET CLI tools and runtime

Details:

USN-6427-1 fixed a vulnerability in .NET. This update provides the corresponding update for .NET 8.

Original advisory details:

It was discovered that the .NET Kestrel web server did not properly handle HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.10: aspnetcore-runtime-8.0 8.0.0~rc2-0ubuntu1 dotnet-host-8.0 8.0.0~rc2-0ubuntu1 dotnet-hostfxr-8.0 8.0.0~rc2-0ubuntu1 dotnet-runtime-8.0 8.0.0~rc2-0ubuntu1 dotnet-sdk-8.0 8.0.100~rc2-0ubuntu1 dotnet8 8.0.100-8.0.0~rc2-0ubuntu1

In general, a standard system update will make all the necessary changes.

Description:

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.

Description:

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202310-0175",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "node healthcheck operator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "big-ip local traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "secure dynamic attributes connector",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2.2.0"
      },
      {
        "model": "varnish cache",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "varnish cache",
        "version": "2023-10-10"
      },
      {
        "model": "decision manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0"
      },
      {
        "model": "big-ip local traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "openshift",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "nginx plus",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "r29"
      },
      {
        "model": "big-ip analytics",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "big-ip link controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "build of quarkus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "netty",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netty",
        "version": "4.1.100"
      },
      {
        "model": "big-ip analytics",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "cost management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "nx-os",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "10.2\\(7\\)"
      },
      {
        "model": "big-ip application security manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.0"
      },
      {
        "model": "big-ip global traffic manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "tomcat",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "apache",
        "version": "8.5.0"
      },
      {
        "model": "visual studio 2022",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "17.0"
      },
      {
        "model": "big-ip analytics",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "big-ip websafe",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "big-ip application acceleration manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "kong gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "konghq",
        "version": "3.4.2"
      },
      {
        "model": "traffic server",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "apache",
        "version": "9.0.0"
      },
      {
        "model": "prime network registrar",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "11.2"
      },
      {
        "model": "big-ip access policy manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "big-ip link controller",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "big-ip access policy manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "big-ip application security manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "openshift virtualization",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "4"
      },
      {
        "model": "jboss enterprise application platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0.0"
      },
      {
        "model": "big-ip domain name system",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "big-ip ddos hybrid defender",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "nginx ingress controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "3.0.0"
      },
      {
        "model": "integration camel k",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "integration service registry",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "big-ip advanced firewall manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "big-ip ssl orchestrator",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "big-ip global traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "migration toolkit for applications",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "6.0"
      },
      {
        "model": "big-ip advanced firewall manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "solr",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apache",
        "version": "9.4.0"
      },
      {
        "model": "big-ip application acceleration manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "big-ip policy enforcement manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "iot field network director",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "4.11.0"
      },
      {
        "model": "big-ip application security manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "openshift distributed tracing",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "visual studio 2022",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "17.6"
      },
      {
        "model": "cbl-mariner",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "2023-10-11"
      },
      {
        "model": "asp.net core",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "6.0.23"
      },
      {
        "model": "big-ip next",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "20.0.1"
      },
      {
        "model": "big-ip advanced firewall manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "big-ip access policy manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "openstack platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "16.2"
      },
      {
        "model": "unified contact center enterprise - live data server",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "12.6.2"
      },
      {
        "model": "nx-os",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "10.3\\(5\\)"
      },
      {
        "model": "big-ip domain name system",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "caddy",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "caddyserver",
        "version": "2.7.5"
      },
      {
        "model": "big-ip ddos hybrid defender",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "big-ip application acceleration manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "big-ip application visibility and reporting",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "expressway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "x14.3.3"
      },
      {
        "model": "big-ip carrier-grade nat",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "nghttp2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "nghttp2",
        "version": "1.57.0"
      },
      {
        "model": "big-ip advanced web application firewall",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "big-ip policy enforcement manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "openshift pipelines",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "big-ip carrier-grade nat",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "unified contact center domain manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "jetty",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "eclipse",
        "version": "12.0.0"
      },
      {
        "model": "openshift secondary scheduler operator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "openstack platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "16.1"
      },
      {
        "model": "grpc",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "grpc",
        "version": "1.58.0"
      },
      {
        "model": "swiftnio http\\/2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "1.28.0"
      },
      {
        "model": "openshift dev spaces",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "windows 10 21h2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "10.0.19044.3570"
      },
      {
        "model": "big-ip carrier-grade nat",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "opensearch data prepper",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "amazon",
        "version": "2.5.0"
      },
      {
        "model": "telepresence video communication server",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "x14.3.3"
      },
      {
        "model": "big-ip application visibility and reporting",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "advanced cluster security",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "4.0"
      },
      {
        "model": "business process automation",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.2.003.009"
      },
      {
        "model": "big-ip advanced web application firewall",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "enterprise chat and email",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "linkerd",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "linkerd",
        "version": "2.12.5"
      },
      {
        "model": "service interconnect",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "1.0"
      },
      {
        "model": "machine deletion remediation operator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "satellite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "6.0"
      },
      {
        "model": "big-ip policy enforcement manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "visual studio 2022",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "17.7.5"
      },
      {
        "model": "windows 11 21h2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "10.0.22000.2538"
      },
      {
        "model": "traefik",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "traefik",
        "version": "3.0.0"
      },
      {
        "model": "single sign-on",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0"
      },
      {
        "model": "ios xr",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "7.11.2"
      },
      {
        "model": "big-ip fraud protection service",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "jetty",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "eclipse",
        "version": "10.0.0"
      },
      {
        "model": "ultra cloud core - serving gateway function",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2024.02.0"
      },
      {
        "model": "secure malware analytics",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2.19.2"
      },
      {
        "model": "self node remediation operator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "big-ip global traffic manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "jboss enterprise application platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "6.0.0"
      },
      {
        "model": "big-ip global traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "big-ip local traffic manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "37"
      },
      {
        "model": "tomcat",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "apache",
        "version": "9.0.80"
      },
      {
        "model": "nx-os",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "10.4\\(1\\)"
      },
      {
        "model": "cryostat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "2.0"
      },
      {
        "model": "oncommand insight",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "big-ip access policy manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "big-ip link controller",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "nginx plus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "r29"
      },
      {
        "model": "node.js",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "20.8.1"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "38"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "6.0"
      },
      {
        "model": "visual studio 2022",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "17.6.8"
      },
      {
        "model": "tomcat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apache",
        "version": "11.0.0"
      },
      {
        "model": "grpc",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "grpc",
        "version": "1.59.2"
      },
      {
        "model": "big-ip analytics",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "openshift api for data protection",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "big-ip ssl orchestrator",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "big-ip local traffic manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "big-ip application security manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "big-ip global traffic manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "integration camel for spring boot",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "istio",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "istio",
        "version": "1.18.0"
      },
      {
        "model": "big-ip application security manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "support for spring boot",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "prime infrastructure",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.10.4"
      },
      {
        "model": "tomcat",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "apache",
        "version": "8.5.93"
      },
      {
        "model": "big-ip websafe",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "nginx plus",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "r25"
      },
      {
        "model": "web terminal",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "nx-os",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "10.4\\(2\\)"
      },
      {
        "model": "big-ip application acceleration manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "ceph storage",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "5.0"
      },
      {
        "model": "big-ip application security manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "proxygen",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "facebook",
        "version": "2023.10.16.00"
      },
      {
        "model": ".net",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "7.0.0"
      },
      {
        "model": "big-ip analytics",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "nx-os",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "10.3\\(1\\)"
      },
      {
        "model": "big-ip policy enforcement manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "firepower threat defense",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "7.4.2"
      },
      {
        "model": "traffic server",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apache",
        "version": "9.2.3"
      },
      {
        "model": "istio",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "istio",
        "version": "1.19.0"
      },
      {
        "model": "http2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "golang",
        "version": "0.17.0"
      },
      {
        "model": "windows 10 1607",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "10.0.14393.6351"
      },
      {
        "model": "big-ip advanced firewall manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "crosswork zero touch provisioning",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.0.0"
      },
      {
        "model": "big-ip carrier-grade nat",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "big-ip application acceleration manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "traffic server",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "apache",
        "version": "8.0.0"
      },
      {
        "model": "windows server 2016",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "node maintenance operator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "networking",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "golang",
        "version": "0.17.0"
      },
      {
        "model": "linkerd",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "linkerd",
        "version": "2.14.0"
      },
      {
        "model": "big-ip advanced web application firewall",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "big-ip fraud protection service",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "grpc",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "grpc",
        "version": "1.57.0"
      },
      {
        "model": ".net",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "7.0.12"
      },
      {
        "model": "big-ip ssl orchestrator",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "big-ip carrier-grade nat",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "big-ip application visibility and reporting",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "big-ip advanced firewall manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "run once duration override operator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "big-ip fraud protection service",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "big-ip next service proxy for kubernetes",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.8.2"
      },
      {
        "model": "grpc",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "grpc",
        "version": "1.56.3"
      },
      {
        "model": "windows 10 22h2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "10.0.19045.3570"
      },
      {
        "model": "big-ip link controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "tomcat",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "apache",
        "version": "10.1.13"
      },
      {
        "model": "visual studio 2022",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "17.7"
      },
      {
        "model": "big-ip fraud protection service",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "advanced cluster management for kubernetes",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "2.0"
      },
      {
        "model": "advanced cluster security",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "3.0"
      },
      {
        "model": "big-ip domain name system",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "big-ip ddos hybrid defender",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "openresty",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "openresty",
        "version": "1.21.4.3"
      },
      {
        "model": "big-ip carrier-grade nat",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "big-ip ssl orchestrator",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "asp.net core",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "6.0.0"
      },
      {
        "model": "windows 10 1809",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "10.0.17763.4974"
      },
      {
        "model": "prime cable provisioning",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "7.2.1"
      },
      {
        "model": "linkerd",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "linkerd",
        "version": "2.14.1"
      },
      {
        "model": "service telemetry framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "1.5"
      },
      {
        "model": "windows server 2019",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "crosswork data gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "5.0.0"
      },
      {
        "model": "jboss fuse",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "6.0.0"
      },
      {
        "model": "big-ip global traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "contour",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "projectcontour",
        "version": "2023-10-11"
      },
      {
        "model": ".net",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "6.0.0"
      },
      {
        "model": "traffic server",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apache",
        "version": "8.1.9"
      },
      {
        "model": "big-ip global traffic manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "nginx plus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "r30"
      },
      {
        "model": "big-ip websafe",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "grpc",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "grpc",
        "version": "1.58.3"
      },
      {
        "model": "big-ip websafe",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "certification for red hat enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "9.0"
      },
      {
        "model": "istio",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "istio",
        "version": "1.17.6"
      },
      {
        "model": "big-ip ssl orchestrator",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "openshift service mesh",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "2.0"
      },
      {
        "model": "data center network manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "jboss core services",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "big-ip policy enforcement manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "openshift sandboxed containers",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "jenkins",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "jenkins",
        "version": "2.427"
      },
      {
        "model": "big-ip ssl orchestrator",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "jboss data grid",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0.0"
      },
      {
        "model": "big-ip link controller",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "big-ip access policy manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "big-ip application acceleration manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "big-ip application security manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "big-ip local traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "big-ip advanced web application firewall",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "node.js",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "20.0.0"
      },
      {
        "model": "azure kubernetes service",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "2023-10-08"
      },
      {
        "model": "jetty",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "eclipse",
        "version": "9.4.53"
      },
      {
        "model": "big-ip advanced web application firewall",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "process automation",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0"
      },
      {
        "model": "big-ip link controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "big-ip carrier-grade nat",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "big-ip application visibility and reporting",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "nginx",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.9.5"
      },
      {
        "model": "big-ip analytics",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "big-ip application security manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "big-ip domain name system",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "big-ip ddos hybrid defender",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "logging subsystem for red hat openshift",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "envoy",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "envoyproxy",
        "version": "1.24.10"
      },
      {
        "model": "big-ip access policy manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "big-ip policy enforcement manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "big-ip fraud protection service",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "envoy",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "envoyproxy",
        "version": "1.27.0"
      },
      {
        "model": "big-ip link controller",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "big-ip fraud protection service",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "big-ip domain name system",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "big-ip ddos hybrid defender",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "big-ip ssl orchestrator",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "crosswork situation manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "big-ip fraud protection service",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "big-ip policy enforcement manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "big-ip global traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "big-ip application visibility and reporting",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "big-ip access policy manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "big-ip advanced web application firewall",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "ultra cloud core - policy control function",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2024.01.0"
      },
      {
        "model": "big-ip advanced firewall manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "istio",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "istio",
        "version": "1.18.3"
      },
      {
        "model": "connected mobile experiences",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "11.1"
      },
      {
        "model": "istio",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "istio",
        "version": "1.19.1"
      },
      {
        "model": "big-ip domain name system",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "big-ip ddos hybrid defender",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "big-ip websafe",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "asp.net core",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "7.0.0"
      },
      {
        "model": "jboss a-mq streams",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "node.js",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "18.18.2"
      },
      {
        "model": "openshift container platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "4.0"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "9.0"
      },
      {
        "model": "crosswork data gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "5.0.2"
      },
      {
        "model": "jetty",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "eclipse",
        "version": "10.0.17"
      },
      {
        "model": "jboss fuse",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0.0"
      },
      {
        "model": "tomcat",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "apache",
        "version": "10.1.0"
      },
      {
        "model": "big-ip advanced web application firewall",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "tomcat",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "apache",
        "version": "9.0.0"
      },
      {
        "model": "big-ip local traffic manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "jetty",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "eclipse",
        "version": "12.0.2"
      },
      {
        "model": "3scale api management platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "2.0"
      },
      {
        "model": "ansible automation platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "2.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "11.0"
      },
      {
        "model": "go",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "golang",
        "version": "1.21.3"
      },
      {
        "model": "traefik",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "traefik",
        "version": "2.10.5"
      },
      {
        "model": "openshift gitops",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "big-ip application acceleration manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "big-ip application visibility and reporting",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "asp.net core",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "7.0.12"
      },
      {
        "model": "go",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "golang",
        "version": "1.21.0"
      },
      {
        "model": "jetty",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "eclipse",
        "version": "11.0.17"
      },
      {
        "model": "big-ip local traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "nginx",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.25.2"
      },
      {
        "model": "windows server 2022",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": "big-ip analytics",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": ".net",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "6.0.23"
      },
      {
        "model": "jboss a-mq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7"
      },
      {
        "model": "visual studio 2022",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "17.2.20"
      },
      {
        "model": "nginx ingress controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "2.0.0"
      },
      {
        "model": "ultra cloud core - session management function",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2024.02.0"
      },
      {
        "model": "big-ip local traffic manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "big-ip analytics",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "big-ip websafe",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "big-ip local traffic manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "big-ip link controller",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "ultra cloud core - policy control function",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2024.01.0"
      },
      {
        "model": "big-ip access policy manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "big-ip access policy manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "openstack platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "17.1"
      },
      {
        "model": "network observability operator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "visual studio 2022",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "17.4.12"
      },
      {
        "model": "node.js",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "18.0.0"
      },
      {
        "model": "http",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "ietf",
        "version": "2.0"
      },
      {
        "model": "unified contact center enterprise",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "big-ip application visibility and reporting",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "big-ip link controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "big-ip analytics",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "crosswork data gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "4.1.3"
      },
      {
        "model": "big-ip advanced firewall manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "openshift developer tools and services",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "envoy",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "envoyproxy",
        "version": "1.26.4"
      },
      {
        "model": "big-ip webaccelerator",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "fence agents remediation operator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "unified attendant console advanced",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "http2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "kazu yamamoto",
        "version": "4.2.2"
      },
      {
        "model": "ios xe",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "17.15.1"
      },
      {
        "model": "big-ip application acceleration manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "big-ip next service proxy for kubernetes",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.5.0"
      },
      {
        "model": "big-ip application visibility and reporting",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "fog director",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.22"
      },
      {
        "model": "certification for red hat enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.0"
      },
      {
        "model": "quay",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "3.0.0"
      },
      {
        "model": "go",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "golang",
        "version": "1.20.10"
      },
      {
        "model": "migration toolkit for virtualization",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "big-ip ssl orchestrator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "prime access registrar",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "9.3.3"
      },
      {
        "model": "big-ip domain name system",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "big-ip advanced firewall manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "big-ip ddos hybrid defender",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "windows 11 22h2",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "10.0.22621.2428"
      },
      {
        "model": "big-ip domain name system",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "big-ip advanced web application firewall",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "big-ip application security manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.0"
      },
      {
        "model": "big-ip application acceleration manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "big-ip ddos hybrid defender",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "cert-manager operator for red hat openshift",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "migration toolkit for containers",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "big-ip carrier-grade nat",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "big-ip policy enforcement manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "big-ip websafe",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "openshift data science",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "h2o",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dena",
        "version": "2023-10-10"
      },
      {
        "model": "big-ip fraud protection service",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "big-ip domain name system",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "big-ip ddos hybrid defender",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "nginx ingress controller",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "2.4.2"
      },
      {
        "model": "http server",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "akka",
        "version": "10.5.3"
      },
      {
        "model": "big-ip advanced firewall manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.5"
      },
      {
        "model": "big-ip ssl orchestrator",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.10"
      },
      {
        "model": "linkerd",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "linkerd",
        "version": "2.13.1"
      },
      {
        "model": "jenkins",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "jenkins",
        "version": "2.414.2"
      },
      {
        "model": "big-ip websafe",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "model": "big-ip policy enforcement manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "linkerd",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "linkerd",
        "version": "2.13.0"
      },
      {
        "model": "big-ip carrier-grade nat",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.0"
      },
      {
        "model": "openshift container platform assisted installer",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "big-ip application visibility and reporting",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.5"
      },
      {
        "model": "astra control center",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "secure web appliance",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "15.1.0"
      },
      {
        "model": "envoy",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "envoyproxy",
        "version": "1.25.9"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "10.0"
      },
      {
        "model": "big-ip websafe",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "apisix",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apache",
        "version": "3.6.1"
      },
      {
        "model": "openshift serverless",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "visual studio 2022",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "17.4"
      },
      {
        "model": "nginx ingress controller",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "3.3.0"
      },
      {
        "model": "armeria",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "linecorp",
        "version": "1.26.0"
      },
      {
        "model": "unified contact center management portal",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "jetty",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "eclipse",
        "version": "11.0.0"
      },
      {
        "model": "big-ip fraud protection service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "17.1.0"
      },
      {
        "model": "big-ip advanced web application firewall",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.0"
      },
      {
        "model": "build of optaplanner",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "8.0"
      },
      {
        "model": "big-ip global traffic manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "16.1.4"
      },
      {
        "model": "linkerd",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "linkerd",
        "version": "2.12.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "12.0"
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-44487"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "175342"
      },
      {
        "db": "PACKETSTORM",
        "id": "175348"
      },
      {
        "db": "PACKETSTORM",
        "id": "175307"
      },
      {
        "db": "PACKETSTORM",
        "id": "175273"
      },
      {
        "db": "PACKETSTORM",
        "id": "175263"
      },
      {
        "db": "PACKETSTORM",
        "id": "175390"
      },
      {
        "db": "PACKETSTORM",
        "id": "176087"
      },
      {
        "db": "PACKETSTORM",
        "id": "175231"
      },
      {
        "db": "PACKETSTORM",
        "id": "175211"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2023-44487",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2023-44487",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2023-44487",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "id": "CVE-2023-44487",
            "trust": 1.0,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-44487"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-44487"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. \n\nThe purpose of this text-only errata is to inform you about the security issues fixed. See references for release notes. \n\n\n\n\nDescription:\n\nThis asynchronous patch is a security update zip for the JBoss EAP XP 4.0.0 runtime distribution for use with EAP 7.4.13. \n\n\n\n\nDescription:\n\nnginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. \n\nThe following advisory data is extracted from:\n\nhttps://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_7610.json\n\nRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat\u0027s archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment. \n\n- Packet Storm Staff\n\n\n\n\n====================================================================\nRed Hat Security Advisory\n\nSynopsis:           Important: OpenShift Container Platform 4.12.45 packages and security update\nAdvisory ID:        RHSA-2023:7610-03\nProduct:            Red Hat OpenShift Enterprise\nAdvisory URL:       https://access.redhat.com/errata/RHSA-2023:7610\nIssue date:         2023-12-06\nRevision:           03\nCVE Names:          CVE-2023-44487\n====================================================================\n\nSummary: \n\nRed Hat OpenShift Container Platform release 4.12.45 is now available with updates to packages and images that fix several bugs and add enhancements. \n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.12. \n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. \n\n\n\n\nDescription:\n\nRed Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. \n\nThis advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.45. See the following advisory for the container images for this release:\n\nhttps://access.redhat.com/errata/RHSA-2023:7608\n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\n* python-werkzeug: high resource consumption leading to denial of service (CVE-2023-46136)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. \n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html\n\n\nSolution:\n\nhttps://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html\n\n\n\nCVEs:\n\nCVE-2023-44487\n\nReferences:\n\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/security/vulnerabilities/RHSB-2023-003\nhttps://bugzilla.redhat.com/show_bug.cgi?id=2242803\nhttps://bugzilla.redhat.com/show_bug.cgi?id=2243296\nhttps://bugzilla.redhat.com/show_bug.cgi?id=2246310\n\n. ==========================================================================\nUbuntu Security Notice USN-6427-2\nOctober 19, 2023\n\ndotnet8 vulnerability\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 23.10\n\nSummary:\n\n.NET could be made to crash if it received specially crafted network\ntraffic. \n\nSoftware Description:\n- dotnet8: .NET CLI tools and runtime\n\nDetails:\n\nUSN-6427-1 fixed a vulnerability in .NET. This update\nprovides the corresponding update for .NET 8. \n\nOriginal advisory details:\n\n   It was discovered that the .NET Kestrel web server did not properly \nhandle\n   HTTP/2 requests. A remote attacker could possibly use this issue to\n   cause a denial of service. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 23.10:\n    aspnetcore-runtime-8.0    8.0.0~rc2-0ubuntu1\n    dotnet-host-8.0                 8.0.0~rc2-0ubuntu1\n    dotnet-hostfxr-8.0             8.0.0~rc2-0ubuntu1\n    dotnet-runtime-8.0            8.0.0~rc2-0ubuntu1\n    dotnet-sdk-8.0                   8.0.100~rc2-0ubuntu1\n    dotnet8                              8.0.100-8.0.0~rc2-0ubuntu1\n\nIn general, a standard system update will make all the necessary changes. \n\n\n\n\nDescription:\n\nVarnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don\u0027t have to create the same web page over and over again, giving the website a significant speed up. \n\n\n\n\nDescription:\n\nNode.js is a software development platform for building fast and scalable network applications in the JavaScript programming language",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-44487"
      },
      {
        "db": "PACKETSTORM",
        "id": "175342"
      },
      {
        "db": "PACKETSTORM",
        "id": "175348"
      },
      {
        "db": "PACKETSTORM",
        "id": "175307"
      },
      {
        "db": "PACKETSTORM",
        "id": "175273"
      },
      {
        "db": "PACKETSTORM",
        "id": "175263"
      },
      {
        "db": "PACKETSTORM",
        "id": "175390"
      },
      {
        "db": "PACKETSTORM",
        "id": "176087"
      },
      {
        "db": "PACKETSTORM",
        "id": "175248"
      },
      {
        "db": "PACKETSTORM",
        "id": "175231"
      },
      {
        "db": "PACKETSTORM",
        "id": "175211"
      }
    ],
    "trust": 1.8
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2023-44487",
        "trust": 2.0
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2023/10/19/6",
        "trust": 1.0
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2023/10/10/6",
        "trust": 1.0
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2023/10/20/8",
        "trust": 1.0
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2023/10/18/4",
        "trust": 1.0
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2023/10/10/7",
        "trust": 1.0
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2023/10/18/8",
        "trust": 1.0
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2023/10/13/4",
        "trust": 1.0
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2023/10/13/9",
        "trust": 1.0
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2025/08/13/6",
        "trust": 1.0
      },
      {
        "db": "PACKETSTORM",
        "id": "175342",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "175348",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "175307",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "175273",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "175263",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "175390",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "176087",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "175248",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "175231",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "175211",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "175342"
      },
      {
        "db": "PACKETSTORM",
        "id": "175348"
      },
      {
        "db": "PACKETSTORM",
        "id": "175307"
      },
      {
        "db": "PACKETSTORM",
        "id": "175273"
      },
      {
        "db": "PACKETSTORM",
        "id": "175263"
      },
      {
        "db": "PACKETSTORM",
        "id": "175390"
      },
      {
        "db": "PACKETSTORM",
        "id": "176087"
      },
      {
        "db": "PACKETSTORM",
        "id": "175248"
      },
      {
        "db": "PACKETSTORM",
        "id": "175231"
      },
      {
        "db": "PACKETSTORM",
        "id": "175211"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-44487"
      }
    ]
  },
  "id": "VAR-202310-0175",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.384739252
  },
  "last_update_date": "2026-03-09T20:20:55.960000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-400",
        "trust": 1.0
      },
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-44487"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.0,
        "url": "http://www.openwall.com/lists/oss-security/2023/10/10/6"
      },
      {
        "trust": 1.1,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803"
      },
      {
        "trust": 1.0,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2023-44487"
      },
      {
        "trust": 1.0,
        "url": "http://www.openwall.com/lists/oss-security/2023/10/18/8"
      },
      {
        "trust": 1.0,
        "url": "https://bugzilla.suse.com/show_bug.cgi?id=1216123"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/wlprq5twuqqxywbjm7ecydail2yvkiuh/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/nodejs/node/pull/50121"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/kubernetes/kubernetes/pull/121120"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/dotnet/announcements/issues/277"
      },
      {
        "trust": 1.0,
        "url": "https://istio.io/latest/news/security/istio-security-2023-004/"
      },
      {
        "trust": 1.0,
        "url": "https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/haproxy/haproxy/issues/2312"
      },
      {
        "trust": 1.0,
        "url": "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html"
      },
      {
        "trust": 1.0,
        "url": "https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/envoyproxy/envoy/pull/30055"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/lkyhszqfdnr7rsa7lhvlliaqmvycugbg/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/oqtane/oqtane.framework/discussions/3367"
      },
      {
        "trust": 1.0,
        "url": "https://blog.vespa.ai/cve-2023-44487/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/kazu-yamamoto/http2/issues/93"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/zkqsikiat5tj3wslu3rdbq35yx4gy4v3/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/advisories/ghsa-qppj-fm5r-hxr3"
      },
      {
        "trust": 1.0,
        "url": "https://bugzilla.proxmox.com/show_bug.cgi?id=4988"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/vsrdiv77hnkusm7sjc5bke5jshlhu2nk/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/h2o/h2o/security/advisories/ghsa-2m7v-gc89-fjqf"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/grpc/grpc-go/pull/6703"
      },
      {
        "trust": 1.0,
        "url": "https://www.debian.org/security/2023/dsa-5558"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/h2o/h2o/pull/3291"
      },
      {
        "trust": 1.0,
        "url": "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#l1101-l1113"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/fna62q767cfafhbcdkynpbmzwb7twyvu/"
      },
      {
        "trust": 1.0,
        "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/zb43remkrqr62njei7i5nq4fsxnlbkrt/"
      },
      {
        "trust": 1.0,
        "url": "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event"
      },
      {
        "trust": 1.0,
        "url": "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/bcdannyboy/cve-2023-44487"
      },
      {
        "trust": 1.0,
        "url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ht7t2r4mqklif4odv4bdlparwfpcj5cz/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/ninenines/cowboy/issues/1615"
      },
      {
        "trust": 1.0,
        "url": "http://www.openwall.com/lists/oss-security/2023/10/10/7"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/facebook/proxygen/pull/466"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/jizsefc3ykcgaba2bzw6zjrmdzjmb7pj/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2"
      },
      {
        "trust": 1.0,
        "url": "https://netty.io/news/2023/10/10/4-1-100-final.html"
      },
      {
        "trust": 1.0,
        "url": "https://news.ycombinator.com/item?id=37830987"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3n4nj7fr4x4fpzugntqapstvb2hb2y4a/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/we2i52rhnnu42px6nz2rbuhsffj2lvzx/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/tempesta-tech/tempesta/issues/1986"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#l73"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ht7t2r4mqklif4odv4bdlparwfpcj5cz/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/akka/akka-http/issues/4323"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/lkyhszqfdnr7rsa7lhvlliaqmvycugbg/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/zb43remkrqr62njei7i5nq4fsxnlbkrt/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/vhuhtsxlxgxs7jykbxta3vinuphtngvu/"
      },
      {
        "trust": 1.0,
        "url": "https://news.ycombinator.com/item?id=37830998"
      },
      {
        "trust": 1.0,
        "url": "https://security.netapp.com/advisory/ntap-20231016-0001/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/jmexy22bfg5q64hqcm5ck2q7kdkvv4ty/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/bfqd3kuemfbhpapbglwqc34l4owl5haz/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/we2i52rhnnu42px6nz2rbuhsffj2lvzx/"
      },
      {
        "trust": 1.0,
        "url": "https://www.debian.org/security/2023/dsa-5540"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/advisories/ghsa-vx74-f528-fxqg"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/x6qxn4orivf6xbw4wwfe7vnpvc74s45y/"
      },
      {
        "trust": 1.0,
        "url": "http://www.openwall.com/lists/oss-security/2025/08/13/6"
      },
      {
        "trust": 1.0,
        "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/readme.md?plain=1#l239-l244"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/e72t67updrxhidlo3oror25yamn4ggw5/"
      },
      {
        "trust": 1.0,
        "url": "https://security.netapp.com/advisory/ntap-20240621-0007/"
      },
      {
        "trust": 1.0,
        "url": "https://news.ycombinator.com/item?id=37831062"
      },
      {
        "trust": 1.0,
        "url": "https://ubuntu.com/security/cve-2023-44487"
      },
      {
        "trust": 1.0,
        "url": "https://security.netapp.com/advisory/ntap-20240426-0007/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/apache/httpd-site/pull/10"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/golang/go/issues/63417"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/lnmzjcdhgljjlxo4oxwjmtvqrnwoc7ul/"
      },
      {
        "trust": 1.0,
        "url": "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/clb4tw7kalb3eeqwnwcn7ouiwwvwwcg2/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/grpc/grpc/releases/tag/v1.59.2"
      },
      {
        "trust": 1.0,
        "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/jizsefc3ykcgaba2bzw6zjrmdzjmb7pj/"
      },
      {
        "trust": 1.0,
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/cve-2023-44487"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/advisories/ghsa-xpw8-rcwv-8f8p"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/vsrdiv77hnkusm7sjc5bke5jshlhu2nk/"
      },
      {
        "trust": 1.0,
        "url": "https://security.paloaltonetworks.com/cve-2023-44487"
      },
      {
        "trust": 1.0,
        "url": "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764"
      },
      {
        "trust": 1.0,
        "url": "http://www.openwall.com/lists/oss-security/2023/10/20/8"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/e72t67updrxhidlo3oror25yamn4ggw5/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ksegd2iwknuo3dwy4kqguqm5bisrwhqe/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/apache/trafficserver/pull/10564"
      },
      {
        "trust": 1.0,
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2023-44487"
      },
      {
        "trust": 1.0,
        "url": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack"
      },
      {
        "trust": 1.0,
        "url": "http://www.openwall.com/lists/oss-security/2023/10/13/4"
      },
      {
        "trust": 1.0,
        "url": "http://www.openwall.com/lists/oss-security/2023/10/19/6"
      },
      {
        "trust": 1.0,
        "url": "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487"
      },
      {
        "trust": 1.0,
        "url": "https://news.ycombinator.com/item?id=37837043"
      },
      {
        "trust": 1.0,
        "url": "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2mbeppc36ubvozznaxfhklfgslcmn5li/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/projectcontour/contour/pull/5826"
      },
      {
        "trust": 1.0,
        "url": "https://lists.w3.org/archives/public/ietf-http-wg/2023octdec/0025.html"
      },
      {
        "trust": 1.0,
        "url": "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088"
      },
      {
        "trust": 1.0,
        "url": "https://www.phoronix.com/news/http2-rapid-reset-attack"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/kong/kong/discussions/11741"
      },
      {
        "trust": 1.0,
        "url": "https://www.debian.org/security/2023/dsa-5549"
      },
      {
        "trust": 1.0,
        "url": "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/bfqd3kuemfbhpapbglwqc34l4owl5haz/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/x6qxn4orivf6xbw4wwfe7vnpvc74s45y/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/zlu6u2r2ic2k64ndpnmv55auao65maf4/"
      },
      {
        "trust": 1.0,
        "url": "https://groups.google.com/g/golang-announce/c/innxdtcjzvo"
      },
      {
        "trust": 1.0,
        "url": "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack"
      },
      {
        "trust": 1.0,
        "url": "https://security.gentoo.org/glsa/202311-09"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/micrictor/http2-rst-stream"
      },
      {
        "trust": 1.0,
        "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html"
      },
      {
        "trust": 1.0,
        "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/vhuhtsxlxgxs7jykbxta3vinuphtngvu/"
      },
      {
        "trust": 1.0,
        "url": "https://mailman.nginx.org/pipermail/nginx-devel/2023-october/s36q5hbxr7caimpllprsssyr4pcmwilk.html"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/etcd-io/etcd/issues/16740"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/arkrwn/poc/tree/main/cve-2023-44487"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/zkqsikiat5tj3wslu3rdbq35yx4gy4v3/"
      },
      {
        "trust": 1.0,
        "url": "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/xfoibb4yfichdm7ibop7pwxw3fx4hll2/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/jmexy22bfg5q64hqcm5ck2q7kdkvv4ty/"
      },
      {
        "trust": 1.0,
        "url": "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/microsoft/cbl-mariner/pull/6381"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/lnmzjcdhgljjlxo4oxwjmtvqrnwoc7ul/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632"
      },
      {
        "trust": 1.0,
        "url": "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/fna62q767cfafhbcdkynpbmzwb7twyvu/"
      },
      {
        "trust": 1.0,
        "url": "https://my.f5.com/manage/s/article/k000137106"
      },
      {
        "trust": 1.0,
        "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
      },
      {
        "trust": 1.0,
        "url": "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/eclipse/jetty.project/issues/10679"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3n4nj7fr4x4fpzugntqapstvb2hb2y4a/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/junkurihara/rust-rpxy/issues/97"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ksegd2iwknuo3dwy4kqguqm5bisrwhqe/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/apache/apisix/issues/10320"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/caddyserver/caddy/releases/tag/v2.7.5"
      },
      {
        "trust": 1.0,
        "url": "https://www.debian.org/security/2023/dsa-5521"
      },
      {
        "trust": 1.0,
        "url": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/line/armeria/pull/5232"
      },
      {
        "trust": 1.0,
        "url": "http://www.openwall.com/lists/oss-security/2023/10/13/9"
      },
      {
        "trust": 1.0,
        "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html"
      },
      {
        "trust": 1.0,
        "url": "http://www.openwall.com/lists/oss-security/2023/10/18/4"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/openresty/openresty/issues/930"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2mbeppc36ubvozznaxfhklfgslcmn5li/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/clb4tw7kalb3eeqwnwcn7ouiwwvwwcg2/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/caddyserver/caddy/issues/5877"
      },
      {
        "trust": 1.0,
        "url": "https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-http2-reset-d8kf32vz"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/alibaba/tengine/issues/1872"
      },
      {
        "trust": 1.0,
        "url": "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/xfoibb4yfichdm7ibop7pwxw3fx4hll2/"
      },
      {
        "trust": 1.0,
        "url": "https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/"
      },
      {
        "trust": 1.0,
        "url": "https://www.debian.org/security/2023/dsa-5522"
      },
      {
        "trust": 1.0,
        "url": "https://access.redhat.com/security/cve/cve-2023-44487"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/wlprq5twuqqxywbjm7ecydail2yvkiuh/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/zlu6u2r2ic2k64ndpnmv55auao65maf4/"
      },
      {
        "trust": 1.0,
        "url": "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125"
      },
      {
        "trust": 1.0,
        "url": "https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause"
      },
      {
        "trust": 1.0,
        "url": "https://aws.amazon.com/security/security-bulletins/aws-2023-011/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/varnishcache/varnish-cache/issues/3996"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/azure/aks/issues/3947"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/nghttp2/nghttp2/pull/1961"
      },
      {
        "trust": 1.0,
        "url": "https://tomcat.apache.org/security-10.html#fixed_in_apache_tomcat_10.1.14"
      },
      {
        "trust": 1.0,
        "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html"
      },
      {
        "trust": 1.0,
        "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html"
      },
      {
        "trust": 1.0,
        "url": "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/opensearch-project/data-prepper/issues/3474"
      },
      {
        "trust": 1.0,
        "url": "https://www.debian.org/security/2023/dsa-5570"
      },
      {
        "trust": 0.9,
        "url": "https://access.redhat.com/security/vulnerabilities/rhsb-2023-003"
      },
      {
        "trust": 0.8,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=red.hat.integration\u0026version=2023-q4"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2023:6117"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_6117.json"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2023:6137"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_6137.json"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2023:6080"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_6080.json"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_5978.json"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/red_hat_jboss_eap_xp_4.0.0_release_notes/index"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2023:5978"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/using_jboss_eap_xp_4.0.0/index"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/jboss_eap_xp_4.0_upgrade_and_migration_guide/index"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_5715.json"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2023:5715"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2023:6144"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_6144.json"
      },
      {
        "trust": 0.1,
        "url": "https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html"
      },
      {
        "trust": 0.1,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246310"
      },
      {
        "trust": 0.1,
        "url": "https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_7610.json"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2023:7608"
      },
      {
        "trust": 0.1,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243296"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2023:7610"
      },
      {
        "trust": 0.1,
        "url": "https://ubuntu.com/security/notices/usn-6427-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/dotnet8/8.0.100-8.0.0~rc2-0ubuntu1"
      },
      {
        "trust": 0.1,
        "url": "https://ubuntu.com/security/notices/usn-6427-2"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification#critical"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2023:5924"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_5924.json"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_5850.json"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2023:5850"
      }
    ],
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "175342"
      },
      {
        "db": "PACKETSTORM",
        "id": "175348"
      },
      {
        "db": "PACKETSTORM",
        "id": "175307"
      },
      {
        "db": "PACKETSTORM",
        "id": "175273"
      },
      {
        "db": "PACKETSTORM",
        "id": "175263"
      },
      {
        "db": "PACKETSTORM",
        "id": "175390"
      },
      {
        "db": "PACKETSTORM",
        "id": "176087"
      },
      {
        "db": "PACKETSTORM",
        "id": "175248"
      },
      {
        "db": "PACKETSTORM",
        "id": "175231"
      },
      {
        "db": "PACKETSTORM",
        "id": "175211"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-44487"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "PACKETSTORM",
        "id": "175342"
      },
      {
        "db": "PACKETSTORM",
        "id": "175348"
      },
      {
        "db": "PACKETSTORM",
        "id": "175307"
      },
      {
        "db": "PACKETSTORM",
        "id": "175273"
      },
      {
        "db": "PACKETSTORM",
        "id": "175263"
      },
      {
        "db": "PACKETSTORM",
        "id": "175390"
      },
      {
        "db": "PACKETSTORM",
        "id": "176087"
      },
      {
        "db": "PACKETSTORM",
        "id": "175248"
      },
      {
        "db": "PACKETSTORM",
        "id": "175231"
      },
      {
        "db": "PACKETSTORM",
        "id": "175211"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-44487"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-10-26T14:32:57",
        "db": "PACKETSTORM",
        "id": "175342"
      },
      {
        "date": "2023-10-26T14:34:38",
        "db": "PACKETSTORM",
        "id": "175348"
      },
      {
        "date": "2023-10-24T15:57:22",
        "db": "PACKETSTORM",
        "id": "175307"
      },
      {
        "date": "2023-10-23T14:26:48",
        "db": "PACKETSTORM",
        "id": "175273"
      },
      {
        "date": "2023-10-23T14:21:23",
        "db": "PACKETSTORM",
        "id": "175263"
      },
      {
        "date": "2023-10-30T12:35:28",
        "db": "PACKETSTORM",
        "id": "175390"
      },
      {
        "date": "2023-12-07T13:59:56",
        "db": "PACKETSTORM",
        "id": "176087"
      },
      {
        "date": "2023-10-20T14:37:00",
        "db": "PACKETSTORM",
        "id": "175248"
      },
      {
        "date": "2023-10-20T14:32:43",
        "db": "PACKETSTORM",
        "id": "175231"
      },
      {
        "date": "2023-10-19T13:51:14",
        "db": "PACKETSTORM",
        "id": "175211"
      },
      {
        "date": "2023-10-10T14:15:10.883000",
        "db": "NVD",
        "id": "CVE-2023-44487"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2025-11-07T19:00:41.810000",
        "db": "NVD",
        "id": "CVE-2023-44487"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "175248"
      }
    ],
    "trust": 0.1
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat Security Advisory 2023-6117-01",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "175342"
      }
    ],
    "trust": 0.1
  }
}