Skip to content
OpenAdvisories

Archive

26 January 2018

Vulnerabilities first published on this day (UTC), newest first.

← December 2017 2018 / January /26 February 2018 →
  1. 111
  2. 240
  3. 357
  4. 466
  5. 527
  6. 64
  7. 71
  8. 859
  9. 933
  10. 10105
  11. 1149
  12. 12118
  13. 1326
  14. 1420
  15. 154
  16. 1645
  17. 176
  18. 18217
  19. 1932
  20. 205
  21. 217
  22. 2227
  23. 2364
  24. 2452
  25. 2539
  26. 2655
  27. 277
  28. 281
  29. 2936
  30. 3023
  31. 3139
All Critical High Medium Low Exploited only Public exploit

55 results · Feed

  • Medium 4.3
    CVE-2017-1000399

    Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

    The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically builds waiting to start). This included information about tasks that the current user otherwise has no access to, e.g. d…

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.8
    CVE-2017-1000403

    Arbitrary code execution vulnerability in Jenkins Speaks! Plugin

    Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM, effectively elevating privileges to Overall/Run Scripts.

    org.jvnet.hudson.plugins:speaks Maven
  • Medium 4.3
    CVE-2017-1000388

    Jenkins Dependency Graph Viewer plugin vulnerable to missing permission checks

    Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing anyone with Overall/Read permission to modify this data.

    org.jenkins-ci.plugins:depgraph-view Maven
  • Medium 5.9
    CVE-2017-1000397

    MitM on Jenkins Maven Plugin

    Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dep…

    org.jenkins-ci.main:maven-plugin Maven
  • Medium 4.3
    CVE-2017-1000390

    Jenkins Multijob plugin did not check permissions in the Resume Build action

    Jenkins Multijob plugin version 1.25 and earlier did not check permissions in the Resume Build action, allowing anyone with Job/Read permission to resume the build.

    org.jenkins-ci.plugins:jenkins-multijob-plugin Maven
  • High 7.5
    CVE-2017-1000394

    Improper Input Validation in Jenkins

    Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability known as CVE-2016-3092. The fix for that vulnerability has been backported to the version of the library bundled with Jen…

    org.jenkins-ci.main:jenkins-core Maven
  • Low 2.2
    CVE-2017-1000401

    Improper Input Validation in Jenkins

    The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being logged…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.8
    CVE-2017-1000392

    Improper Neutralization of Input During Web Page Generation in Jenkins

    Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters l…

    org.jenkins-ci.main:jenkins-core Maven
  • High 7.3
    CVE-2017-1000391

    Improper Input Validation in Jenkins

    Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID fo…

    org.jenkins-ci.main:jenkins-core Maven
  • High 7.8
    CVE-2017-1000387

    Jenkins Build-Publisher plugin has Insufficiently Protected Credentials

    Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyon…

    org.jenkins-ci.plugins:build-publisher Maven
  • Medium 4.3
    CVE-2017-1000400

    Missing Authorization in Jenkins

    The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/R…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 5.9
    CVE-2017-1000396

    Improper Certificate Validation in Jenkins

    Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. This library is widely used a…

    org.jenkins-ci.main:jenkins-core Maven
  • Unscored —
    CVE-2017-14593

    Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An att…

    Atlassian Sourcetree for Windows Windows
  • Unscored —
    CVE-2017-14592

    Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attac…

    Atlassian Sourcetree for macOS macOS
  • Unscored —
    CVE-2017-3762

    Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon cr…

    Lenovo Lenovo Fingerprint Manager Pro