Archive
January 2018
Vulnerabilities first published in this month (UTC), newest first.
1,275 results · Feed
-
High 8.8
XXE vulnerability in Jenkins DRY Plugin
Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial…
-
High 8.8
CSRF vulnerability in Jenkins Release plugin
Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to trigger release builds.
-
High 8.8
XML External Entity Reference in Jenkins FindBugs Plugin
Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or d…
-
High 8.8
XXE vulnerability Jenkins Warnings Plugin
Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or d…
-
High 8.8
XXE vulnerability in Jenkins Checkstyle Plugin
Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or…
-
Medium 4.8
Incorrect permission checks in Pipeline: Nodes and Processes plugin
On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. This did not prevent the execution of Pipeline `node` blocks on those agents due to incorrect permissions che…
-
Unscored —
The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the co…
-
Unscored —
Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authe…
-
Medium 5.5
SilverStripe CSV Excel Macro Injection
In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain macros and scripts, which may be executed if imported without sanitization into common software (including Microsoft Exce…
-
Unscored —
Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for ex…
-
Unscored —CVE-2016-5345 Public exploit
Buffer overflow in the Qualcomm radio driver in Android before 2017-01-05 on Android One devices allows local users to …
-
Unscored —
This vulnerability allows remote attackers to overwrite files on vulnerable installations of NetGain Systems Enterprise…
-
Unscored —
This vulnerability allows remote attackers to execute code by overwriting arbitrary files on vulnerable installations o…
-
Unscored —
This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of NetGain Systems Ent…
-
Unscored —
This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Ent…
-
Unscored —
This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of N…
-
Unscored —
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Sys…
-
Unscored —
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Sys…
-
Unscored —
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Ente…
-
Unscored —
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Sys…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise …
-
Unscored —CVE-2017-16603 EPSS 54%
This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of N…
-
Unscored —
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Sys…
-
Unscored —
This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems …
-
Unscored —CVE-2017-16597 EPSS 57%
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Ent…
-
Unscored —
This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems …
-
Unscored —
This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems …
-
Unscored —
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Ent…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Ent…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise …
-
Unscored —
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Ent…
-
Unscored —
This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Ent…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Ent…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise …
-
Unscored —
Cross-site scripting (XSS) in BigTree 4.2.19 allows any remote users to inject arbitrary web script or HTML via the dir…
-
Unscored —
Subsonic v6.1.3 has an insecure allow-access-from domain="*" Flash cross-domain policy that allows an attacker to retri…
-
Unscored —CVE-2018-0845 EPSS 20%
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Micr…
-
Unscored —CVE-2018-0862 EPSS 19%
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Micr…
-
Unscored —CVE-2018-0849 EPSS 19%
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Micr…
-
Unscored —CVE-2018-0848 EPSS 20%
Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Micr…