Skip to content
OpenAdvisories

Archive

17 October 2014

Vulnerabilities first published on this day (UTC), newest first.

← September 2014 2014 / October /17 November 2014 →
  1. 18
  2. 254
  3. 330
  4. 429
  5. 56
  6. 628
  7. 720
  8. 842
  9. 96
  10. 1051
  11. 1111
  12. 122
  13. 1316
  14. 1411
  15. 15196
  16. 16126
  17. 1723
  18. 1825
  19. 19244
  20. 20146
  21. 21181
  22. 2219
  23. 2310
  24. 242
  25. 2521
  26. 2612
  27. 2716
  28. 289
  29. 2933
  30. 307
  31. 3129
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium —
    CVE-2013-7330

    Jenkins allows attackers to configure restricted projects

    Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actions.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-7960

    OpenStack Swift metadata constraints are not correctly enforced

    OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.

    swift swift swift Debian Ubuntu PyPI
  • Medium —
    CVE-2014-2065

    Jenkins cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2063

    Jenkins Vulnerable to Clickjacking

    Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2066

    Jenkins session fixation vulnerability

    Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2062

    Jenkins does not invalidate the API token when a user is deleted

    Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2060

    Jenkins allows Remote Attackers to Hijack Sessions

    The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2058

    Jenkins allows attackers to execute arbitrary jobs

    BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix fo…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2061

    Jenkin allows attackers to obtain passwords by reading the HTML source code

    The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2014-2064 Public exploit

    Jenkins allows attackers to determine whether a user exists

    The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.

    org.jenkins-ci.main:jenkins-core Maven