Skip to content
OpenAdvisories

Archive

17 May 2016

Vulnerabilities first published on this day (UTC), newest first.

← April 2016 2016 / May /17 June 2016 →
  1. 18
  2. 236
  3. 34
  4. 4 
  5. 525
  6. 67
  7. 718
  8. 8 
  9. 941
  10. 105
  11. 11156
  12. 125
  13. 1325
  14. 1425
  15. 153
  16. 1627
  17. 1713
  18. 184
  19. 191
  20. 2084
  21. 212
  22. 2240
  23. 2328
  24. 241
  25. 2513
  26. 2614
  27. 27 
  28. 283
  29. 292
  30. 307
  31. 3115
All Critical High Medium Low Exploited only Public exploit

13 results · Feed

  • Unscored —
    CVE-2016-0323

    The Auto-Scaling agent in Liberty for Java in IBM Bluemix before 2.7-20160321-1358 allows remote authenticated users to…

  • Unscored —
    CVE-2016-0306

    IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.41, 8.0 before 8.0.0.13, and 8.5 before 8.5.5.10, when FIPS 140…

  • Medium 6.5
    CVE-2016-4425

    Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumpt…

    jansson jansson Debian Ubuntu
  • High 7.5
    CVE-2016-3627 Public exploit

    The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-de…

    libxml2 libxml2 Debian Ubuntu
  • Medium 4.3
    CVE-2016-3725

    Missing permissions check in Jenkins Core

    Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missing permissions check. NOTE: this issue can be combined with DNS cache poisoning to cause a denial of service (service …

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2016-3722

    Incorrect Authorization in Jenkins Core

    Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name."

    org.jenkins-ci.main:jenkins-core Maven
  • Unscored —
    CVE-2016-3705

    The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly kee…

    libxml2 libxml2 Debian Ubuntu
  • Medium 4.3
    CVE-2016-3727

    Jenkins Exposes Sensitive Information via API URL

    The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.5
    CVE-2016-3724

    Jenkins Exposes Sensitive Information from Job Configuration

    Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job configuration.

    org.jenkins-ci.main:jenkins-core Maven
  • High 7.4
    CVE-2016-3726

    Jenkins affected by Open Redirect Vulnerability

    Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to "scheme-relative" URLs.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2016-3723

    Exposure of Sensitive Information in Jenkins Core

    Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.

    org.jenkins-ci.main:jenkins-core Maven
  • High 7.5
    CVE-2016-3674

    XML External Entity Injection in XStream

    Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary fil…

    com.thoughtworks.xstream:xstream libxstream-java libxstream-java Debian Ubuntu Maven
  • Medium 4.3
    CVE-2016-3721

    Jenkins allows Remote Users to Inject Build Parameters

    Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables.

    org.jenkins-ci.main:jenkins-core Maven