Skip to content
OpenAdvisories

Archive

May 2018

Vulnerabilities first published in this month (UTC), newest first.

← April 2018 2018 / May June 2018 →
  1. 131
  2. 263
  3. 313
  4. 435
  5. 55
  6. 64
  7. 719
  8. 829
  9. 9105
  10. 1049
  11. 1125
  12. 127
  13. 134
  14. 1450
  15. 1537
  16. 1628
  17. 17139
  18. 1831
  19. 1938
  20. 204
  21. 2113
  22. 2263
  23. 2332
  24. 2455
  25. 2546
  26. 2617
  27. 27 
  28. 2811
  29. 2980
  30. 3030
  31. 31101
All Critical High Medium Low Exploited only Public exploit

95 results · Clear filters · Feed

  • Medium 5.4
    CVE-2018-6510

    XSS Vulnerability in Puppet Enterprise Console

    A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Orchestrator. Affected releases are Puppet Puppet Enterprise: 2017.3.x versions prior to 2…

    Puppet Puppet Enterprise
  • Medium 4.3
    CVE-2017-2611

    Incorrect Authorization in Jenkins Core

    Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to t…

    org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • Medium 5.4
    CVE-2017-2594

    Path Traversal in io.hawt:project

    hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's…

    io.hawt:project Maven
  • Medium 5.9
    CVE-2017-2592

    oslo.middleware Information Disclosure vulnerability

    python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitiv…

    python-oslo.middleware python-oslo.middleware oslo-middleware Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2018-1000176

    Jenkins Email Extension Plugin showed plain text SMTP password in configuration form field

    An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/ExtendedEmailPublisher/global.groovy and ExtendedEmailPublisherDescriptor.java that allows attackers with …

    org.jenkins-ci.plugins:email-ext Maven
  • Medium 5.4
    CVE-2018-1000174

    Jenkins Google Login Plugin Open Redirect vulnerability

    An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to an arbitrary URL after successful login.

    org.jenkins-ci.plugins:google-login Maven
  • Medium 5.9
    CVE-2018-1000173

    Jenkins Google Login Plugin Session Fixation vulnerability

    A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.

    org.jenkins-ci.plugins:google-login Maven
  • Medium 5.4
    CVE-2018-1000177

    Stored XSS vulnerability in Jenkins S3 Publisher Plugin

    A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containin…

    org.jenkins-ci.plugins:s3 Maven
  • Medium 6.5
    CVE-2018-1000175

    Jenkins HTML Publisher Plugin path traversal vulnerability

    A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers able to configure the HTML Publisher build step to override arbitrary files on the Jenkins master.

    org.jenkins-ci.plugins:htmlpublisher Maven
  • Medium 5.3
    CVE-2018-1313 Public exploit

    Improper Access Control in Apache Derby

    In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Secur…

    Apache Software Foundation Apache Derby org.apache.derby:derby derby Debian Ubuntu Maven
  • Medium 4.9
    CVE-2018-5446

    Medtronic 2090 Carelink Programmer Storing Passwords in a Recoverable Format

    Medtronic 2090 CareLink Programmer uses a per-product username and password that is stored in a recoverable format.

    Medtronic 29901 Encore Programmer 2090 CareLink Programmer
  • Medium 4.8
    CVE-2018-5448

    Medtronic 2090 Carelink Programmer Relative Path Traversal

    Medtronic 2090 CareLink Programmer’s software deployment network contains a directory traversal vulnerability that could allow an attacker to read files on the system.

    Medtronic 29901 Encore Programmer 2090 CareLink Programmer
  • Medium 5.4
    CVE-2018-10726

    A stored XSS vulnerability was found in Datenstrom Yellow 0.7.3 via an "Edit page" action. NOTE: the vendor disputes th…

  • Medium 6.8
    CVE-2017-5535

    TIBCO DataSynapse GridServer improper use of encryption

    The GridServer Broker, GridServer Driver, and GridServer Engine components of TIBCO Software Inc. TIBCO DataSynapse GridServer Manager contain vulnerabilities related to both the improper use of encryption mechanisms and the use of weak ciphers. A malicious a…

    TIBCO Software TIBCO DataSynapse GridServer Manager
  • Medium 6.3
    CVE-2017-5536

    TIBCO DataSynapse GridServer manager component vulnerable to cross-site scripting attacks

    The GridServer Broker, and GridServer Director components of TIBCO Software Inc. TIBCO DataSynapse GridServer Manager contain vulnerabilities which may allow an authenticated user to perform cross-site scripting (XSS). In addition, an authenticated user could…

    TIBCO Software TIBCO DataSynapse GridServer Manager