Archive
5 June 2018
Vulnerabilities first published on this day (UTC), newest first.
60 results · Feed
-
Medium 6.5
XML External Entity processing vulnerability in Jenkins Black Duck Hub Plugin
A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read permission to make Jenkins process XML eternal entities in an XML document.
-
Medium 5.4
Jenkins Groovy Postbuild Plugin vulnerable to Cross-site Scripting
A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser whe…
-
Medium 4.3
Cross-Site Request Forgery in Jenkins
A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether …
-
High 8.1
Path Traversal in Jenkins
A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subs…
-
High 8.1
Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration
An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/Read permission to read and write the Black Duck Hub plugin configuration.
-
Medium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read access to enumerate all installed plugins.
-
Medium 6.5
Jenkins Gitlab Hook Plugin stores and displays GitLab API token in plain text
A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_notifier/global.erb that allows attackers with local Jenkins master file system access or control of a Jenkins administr…
-
Medium 4.3
Injection in Jenkins
A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have t…
-
Unscored —
An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a ne…
-
Unscored —
XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to r…
-
Unscored —
Some implementations in Intel Integrated Performance Primitives Cryptography Library before version 2018 U3.1 do not pr…
-
Unscored —
The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to execute…
-
Unscored —
The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write t…
-
Unscored —
QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections.
-
Unscored —
QNAP NAS application Proxy Server through version 1.2.0 does not authenticate requests properly. Successful exploitatio…
-
Unscored —
Cross-site scripting (XSS) vulnerability in QNAP NAS application Proxy Server through version 1.2.0 allows remote attac…
-
Unscored —
QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against th…
-
Medium 4.2
Jenkins GitHub Pull Request Builder Plugin credential capture vulnerability
A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified cre…
-
Medium 5.4
Jenkins GitHub Plugin server-side request forgery vulnerability exists
A server-side request forgery vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubPluginConfig.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.
-
Medium 6.5
Jenkins Black Duck Detect Plugin information exposure vulnerability
A exposure of sensitive information vulnerability exists in Jenkins Black Duck Detect Plugin 1.4.0 and older in DetectPostBuildStepDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified …
-
Medium 5.4
Jenkins CAS Plugin Server-Side Request Forgery vulnerability
A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.
-
Medium 6.4
Server-Side Request Forgery in Jenkins Git Plugin
A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2013GitRepositoryBrowser.java, ViewGitWeb.java that allows attackers with Overall/Read access to caus…
-
High 8.8
CSRF vulnerability and missing permission checks in Jenkins AbsInt Astrée Plugin
A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with Overall/Read access to execute a command on the Jenkins master.
-
Medium 6.5
Exposure of Sensitive Information in Jenkins Kubernetes Plugin
A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that results in sensitive variables such as passwords being written to logs.
-
Medium 4.3
Jenkins GitHub Branch Source Plugin vulnerable to Server-Side Request Forgery
A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.
-
Medium 6.5
Jenkins GitHub Plugin exposure of sensitive information vulnerability exists
A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtai…
-
Medium 6.5
Exposure of sensitive information vulnerability in Jenkins Black Duck Hub Plugin
A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentia…
-
Unscored —
IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Moni…
-
Unscored —
IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Moni…
-
Unscored —
IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Moni…
-
Unscored —
In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthentic…
-
Unscored —
The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client …
-
Medium 6.5
Moderate severity vulnerability that affects org.apache.storm:storm-core
Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another user when communicating with some Storm Daemons.
-
Medium 5.5
ZipSlip in org.apache.storm:storm-core
Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), …
-
Unscored —
There is an authentication bypass vulnerability in some Huawei servers. A remote attacker with low privilege may bypass…
-
Medium 6.1
IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to cross-frame scripting which is a vulnerabi…
-
Medium 5.9
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to obtain sensitive information, c…
-
Unscored —
An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02_passport.…
-
Unscored —
In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visi…
-
High 8.4
IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 could allow a user to escalate their privileges to administ…