Skip to content
OpenAdvisories

Archive

5 April 2018

Vulnerabilities first published on this day (UTC), newest first.

← March 2018 2018 / April /5 May 2018 →
  1. 18
  2. 225
  3. 3170
  4. 4163
  5. 557
  6. 614
  7. 710
  8. 85
  9. 914
  10. 1050
  11. 1188
  12. 12112
  13. 1346
  14. 148
  15. 157
  16. 1641
  17. 1731
  18. 18282
  19. 19200
  20. 2036
  21. 2110
  22. 2210
  23. 2327
  24. 2497
  25. 2547
  26. 2636
  27. 2729
  28. 283
  29. 2915
  30. 3029
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 5.3
    CVE-2017-12093

    An exploitable insufficient resource pool vulnerability exists in the session communication functionality of Allen Brad…

    Talos Allen Bradley
  • Medium 6.5
    CVE-2017-12095

    An exploitable vulnerability exists in the WiFi Access Point feature of Circle with Disney running firmware 2.0.1. A se…

    Circle Media Circle
  • Medium 5.4
    CVE-2018-7035

    Gleez CMS Stored XSS

    Cross-site scripting (XSS) vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers (users) to inject JavaScript via HTML content in an editor, which will result in Stored XSS when an Administrator tries to edit the same content, as demonstrated …

    gleez/cms Packagist
  • Medium 5.6
    CVE-2018-1000151

    Jenkins vSphere Plugin disables SSL/TLS certificate validation by default

    A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default.

    org.jenkins-ci.plugins:vsphere-cloud Maven
  • Medium 6.5
    CVE-2018-1000145

    Jenkins Perforce Plugin uses ineffective credentials encryption

    An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with local file system access to obtain encrypted Perforce passwords and decrypt them.

    org.jvnet.hudson.plugins:perforce Maven
  • Medium 6.3
    CVE-2018-1000152

    Jenkins vSphere Plugin incorrect authorization vulnerability

    An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereClo…

    org.jenkins-ci.plugins:vsphere-cloud Maven
  • Medium 5.6
    CVE-2018-1000149

    Jenkins Ansible Plugin man in the middle vulnerability

    A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuild…

    org.jenkins-ci.plugins:ansible Maven
  • Medium 6.5
    CVE-2018-1000147

    Jenkins Perforce Plugin exposure of sensitive information vulnerability exists

    An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with insufficient permission to obtain Perforce passwords configured in jobs to obtain them

    org.jvnet.hudson.plugins:perforce Maven
  • Medium 6.5
    CVE-2018-1000148

    Jenkins Copy To Slave Plugin allows access to arbitrary files on the Jenkins controller file system

    An exposure of sensitive information vulnerability exists in Jenkins Copy To Slave Plugin version 1.4.4 and older in CopyToSlaveBuildWrapper.java that allows attackers with permission to configure jobs to read arbitrary files from the Jenkins master file syst…

    org.jenkins-ci.plugins:copy-to-slave Maven
  • Medium 4.0
    CVE-2018-1000142

    Jenkins GitHub Pull Request Builder Plugin allows attacker with local file system access to obtain GitHub credentials

    An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials.

    org.jenkins-ci.plugins:ghprb Maven
  • Medium 6.1
    CVE-2018-1000144

    Jenkins Cucumber Living Documentation Plugin Cross-site Scripting vulnerability

    A cross site scripting vulnerability exists in Jenkins Cucumber Living Documentation Plugin 1.0.12 and older in CukedoctorBaseAction#doDynamic that disables the Content-Security-Policy protection for archived artifacts and workspace files, allowing attackers …

    org.jenkins-ci.plugins:cucumber-living-documentation Maven