Archive
15 May 2018
Vulnerabilities first published on this day (UTC), newest first.
37 results · Feed
-
Unscored —
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versi…
-
Unscored —
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versi…
-
Unscored —
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versi…
-
Unscored —
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versi…
-
Unscored —
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versi…
-
Unscored —
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versi…
-
Unscored —
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versi…
-
Unscored —
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versi…
-
Unscored —
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versi…
-
Unscored —
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versi…
-
Unscored —
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versi…
-
Medium 5.4
Cross-Site Request Forgery in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (S…
-
Medium 5.4
Improper Neutralization of Input During Web Page Generation in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than characters in their names (SECURITY-388).
-
Low 3.1
Incomplete List of Disallowed Inputs in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents (SECURITY-358).
-
Low 2.6
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362).
-
Medium 4.3
Improper Authentication in Jenkins
In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks (SECURITY-371).
-
Medium 4.7CVE-2018-1263 Public exploit
spring-integration-zip Arbitrary File Write
Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cp…
-
High 7.2
UAA privilege escalation across identity zones
Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impers…
-
High 8.8
Deserialization of Untrusted Data in Jenkins
Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs (SECURITY-383).
-
Medium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343).
-
Medium 5.4
Incorrect Permission Assignment for Critical Resource in Jenkins
In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in future builds possibly failing to download a JDK.
-
Unscored —
An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/Reb…
-
Unscored —
e107 2.1.7 has CSRF resulting in arbitrary user deletion.
-
Unscored —
dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account.
-
High 8.1
An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. A specially craft…
-
High 8.0
kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulner…
-
Unscored —
There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka…
-
Unscored —
Bounds check vulnerability in User Mode Driver in Intel Graphics Driver 15.40.x.4 and 21.20.x.x allows unprivileged use…
-
Unscored —
Buffer overflow in Intel system Configuration utilities selview.exe and syscfg.exe before version 14 build 11 allows a …
-
Unscored —
Parameter corruption in NDIS filter driver in Intel Online Connect Access 1.9.22.0 allows an attacker to cause a denial…
-
High 8.8
Deserialization of Untrusted Data in Infinispan
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects…
-
Unscored —
Mimo Baby 2 devices do not use authentication or encryption for the Bluetooth Low Energy (BLE) communication from a Tur…
-
Unscored —
An issue was discovered in Libav 12.3. A read access violation in the mov_probe function in libavformat/mov.c allows re…
-
Unscored —
An issue was discovered in cloudwu/cstring through 2016-11-09. There is a memory leak vulnerability that could lead to …
-
Unscored —
An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upl…
-
Unscored —
The decompileSETTARGET function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a f…
-
Unscored —
The decompileJUMP function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file s…