Skip to content
OpenAdvisories

Archive

26 January 2018

Vulnerabilities first published on this day (UTC), newest first.

← December 2017 2018 / January /26 February 2018 →
  1. 111
  2. 240
  3. 357
  4. 466
  5. 527
  6. 64
  7. 71
  8. 859
  9. 933
  10. 10105
  11. 1149
  12. 12118
  13. 1326
  14. 1420
  15. 154
  16. 1645
  17. 176
  18. 18217
  19. 1932
  20. 205
  21. 217
  22. 2227
  23. 2364
  24. 2452
  25. 2539
  26. 2655
  27. 277
  28. 281
  29. 2936
  30. 3023
  31. 3139
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.5
    CVE-2017-18076

    Omniauth allows POST parameters to be stored in session

    In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.

    omniauth ruby-omniauth ruby-omniauth Debian Ubuntu RubyGems
  • High 8.8
    CVE-2017-1000393

    OS Command Injection in Jenkins

    Jenkins 2.73.1 and earlier, 2.83 and earlier users with permission to create or configure agents in Jenkins could configure a launch method called 'Launch agent via execution of command on master'. This allowed them to run arbitrary shell commands on the mast…

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.8
    CVE-2017-1000403

    Arbitrary code execution vulnerability in Jenkins Speaks! Plugin

    Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM, effectively elevating privileges to Overall/Run Scripts.

    org.jvnet.hudson.plugins:speaks Maven
  • High 7.5
    CVE-2017-1000394

    Improper Input Validation in Jenkins

    Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability known as CVE-2016-3092. The fix for that vulnerability has been backported to the version of the library bundled with Jen…

    org.jenkins-ci.main:jenkins-core Maven
  • High 7.3
    CVE-2017-1000391

    Improper Input Validation in Jenkins

    Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID fo…

    org.jenkins-ci.main:jenkins-core Maven
  • High 7.8
    CVE-2017-1000387

    Jenkins Build-Publisher plugin has Insufficiently Protected Credentials

    Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyon…

    org.jenkins-ci.plugins:build-publisher Maven