Skip to content
OpenAdvisories

Archive

23 January 2018

Vulnerabilities first published on this day (UTC), newest first.

← December 2017 2018 / January /23 February 2018 →
  1. 111
  2. 240
  3. 357
  4. 466
  5. 527
  6. 64
  7. 71
  8. 859
  9. 933
  10. 10105
  11. 1149
  12. 12118
  13. 1326
  14. 1420
  15. 154
  16. 1645
  17. 176
  18. 18217
  19. 1932
  20. 205
  21. 217
  22. 2227
  23. 2364
  24. 2452
  25. 2539
  26. 2655
  27. 277
  28. 281
  29. 2936
  30. 3023
  31. 3139
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.5
    CVE-2017-12632

    Apache NiFi host header poisoning issue

    A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x rele…

    Apache Software Foundation Apache NiFi org.apache.nifi:nifi Maven
  • High 8.8
    CVE-2018-1000014

    CSRF vulnerability in Jenkins Translation Assistance plugin

    Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to override localized strings displayed to all users on the current Jenkins instance if the …

    org.jenkins-ci.plugins:translation Maven
  • High 8.8
    CVE-2018-1000008

    XXE vulnerability in Jenkins PMD Plugin

    Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial…

    org.jvnet.hudson.plugins:pmd Maven
  • High 8.8
    CVE-2018-1000010

    XXE vulnerability in Jenkins DRY Plugin

    Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial…

    org.jvnet.hudson.plugins:dry Maven
  • High 8.8
    CVE-2018-1000013

    CSRF vulnerability in Jenkins Release plugin

    Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to trigger release builds.

    org.jenkins-ci.plugins:release Maven
  • High 8.8
    CVE-2018-1000011

    XML External Entity Reference in Jenkins FindBugs Plugin

    Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or d…

    org.jvnet.hudson.plugins.findbugs:library Maven
  • High 8.8
    CVE-2018-1000012

    XXE vulnerability Jenkins Warnings Plugin

    Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or d…

    org.jvnet.hudson.plugins:warnings Maven
  • High 8.8
    CVE-2018-1000009

    XXE vulnerability in Jenkins Checkstyle Plugin

    Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or…

    org.jvnet.hudson.plugins:checkstyle Maven