Skip to content
OpenAdvisories

Archive

3 February 2016

Vulnerabilities first published on this day (UTC), newest first.

← January 2016 2016 / February /3 March 2016 →
  1. 121
  2. 2 
  3. 312
  4. 42
  5. 52
  6. 66
  7. 720
  8. 827
  9. 94
  10. 1071
  11. 111
  12. 1214
  13. 1314
  14. 146
  15. 1530
  16. 1613
  17. 1727
  18. 1814
  19. 196
  20. 209
  21. 214
  22. 2227
  23. 236
  24. 243
  25. 257
  26. 262
  27. 278
  28. 2812
  29. 2912
All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • High 8.8
    CVE-2015-7537

    Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

    Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.8
    CVE-2015-7538

    Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

    Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 5.4
    CVE-2015-7536

    Improper Neutralization of Input During Web Page Generation in Jenkins

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.

    org.jenkins-ci.main:jenkins-core Maven
  • High 7.5
    CVE-2015-7539

    Jenkins does not Verify Checksums for Plugin Files

    The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin.

    org.jenkins-ci.main:jenkins-core Maven
  • High 7.5
    CVE-2015-7546

    OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials

    The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization token…

    keystone keystone python-keystonemiddleware keystonemiddleware Debian PyPI
  • Critical 10.0
    CVE-2015-8747

    Radicale vulnerable to arbitrary file read or write

    The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

    radicale radicale Debian PyPI
  • Medium 5.3
    CVE-2015-8748

    Radicale regex metacharacters injection in the user name

    Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by ".*".

    radicale radicale Debian PyPI
  • Critical 9.8
    CVE-2015-5344

    Camel-xstream component in Apache Camel can allow remote attackers to execute arbitrary commands

    The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.

    org.apache.camel:camel-xstream Maven
  • Critical 10.0
    CVE-2016-1505

    Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component

    The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.

    radicale PyPI
  • Critical 9.8
    CVE-2016-1906

    Authorization bypass in Openshift

    Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.

    github.com/openshift/origin Go
  • High 7.7
    CVE-2016-1905

    Access Restriction Bypass in kubernetes

    The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object.

    github.com/kubernetes/kubernetes Go
  • Unscored —
    CVE-2016-2213

    The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a…

    ffmpeg ffmpeg ffmpeg Debian Ubuntu Alpine