Skip to content
OpenAdvisories

Archive

26 January 2018

Vulnerabilities first published on this day (UTC), newest first.

← December 2017 2018 / January /26 February 2018 →
  1. 111
  2. 240
  3. 357
  4. 466
  5. 527
  6. 64
  7. 71
  8. 859
  9. 933
  10. 10105
  11. 1149
  12. 12118
  13. 1326
  14. 1420
  15. 154
  16. 1645
  17. 176
  18. 18217
  19. 1932
  20. 205
  21. 217
  22. 2227
  23. 2364
  24. 2452
  25. 2539
  26. 2655
  27. 277
  28. 281
  29. 2936
  30. 3023
  31. 3139
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Medium 6.1
    CVE-2017-14522

    In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious Java…

  • Medium 6.1
    CVE-2017-1000404

    Jenkins Delivery Pipeline Plugin Cross-site Scripting vulnerability

    The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScript, resulting in a cross-site scripting vulnerability through specially crafted URLs.

    se.diabol.jenkins.pipeline:delivery-pipeline-plugin Maven
  • Medium 6.1
    CVE-2017-1000389

    Cross-Site Request Forgery (CSRF) vulnerability in Jenkins global-build-stats plugin

    Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had the Content Type: text/html, so could have been interpreted as HTML by clients, resulting in a pote…

    org.jenkins-ci.plugins:global-build-stats Maven
  • Medium 5.9
    CVE-2017-1000402

    Jenkins Swarm Plugin Client vulnerable to man-in-the-middle attacks

    Jenkins Swarm Plugin Client 3.4 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks.

    org.jvnet.hudson.plugins:swarm-plugin org.jenkins-ci.plugins:swarm-client Maven
  • Medium 4.3
    CVE-2017-1000398

    Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

    The remote API in Jenkins 2.73.1 and earlier, 2.83 and earlier at /computer/(agent-name)/api showed information about tasks (typically builds) currently running on that agent. This included information about tasks that the current user otherwise has no access…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 5.4
    CVE-2017-1000386

    Cross-site Scripting in Jenkins Active Choices plugin

    Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Parameters' page through the 'Active Choices Reactive Reference Parameter' type. This could include, f…

    org.biouno:uno-choice Maven
  • Medium 4.3
    CVE-2017-1000395

    Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

    Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Overall/Read permissions via the /user/(username)/api remote API. This included e.g. Jenkins users' email addresses if th…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2017-1000399

    Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

    The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically builds waiting to start). This included information about tasks that the current user otherwise has no access to, e.g. d…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2017-1000388

    Jenkins Dependency Graph Viewer plugin vulnerable to missing permission checks

    Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing anyone with Overall/Read permission to modify this data.

    org.jenkins-ci.plugins:depgraph-view Maven
  • Medium 5.9
    CVE-2017-1000397

    MitM on Jenkins Maven Plugin

    Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dep…

    org.jenkins-ci.main:maven-plugin Maven
  • Medium 4.3
    CVE-2017-1000390

    Jenkins Multijob plugin did not check permissions in the Resume Build action

    Jenkins Multijob plugin version 1.25 and earlier did not check permissions in the Resume Build action, allowing anyone with Job/Read permission to resume the build.

    org.jenkins-ci.plugins:jenkins-multijob-plugin Maven
  • Medium 4.8
    CVE-2017-1000392

    Improper Neutralization of Input During Web Page Generation in Jenkins

    Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters l…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2017-1000400

    Missing Authorization in Jenkins

    The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/R…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 5.9
    CVE-2017-1000396

    Improper Certificate Validation in Jenkins

    Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. This library is widely used a…

    org.jenkins-ci.main:jenkins-core Maven