Skip to content
OpenAdvisories

Archive

5 June 2018

Vulnerabilities first published on this day (UTC), newest first.

← May 2018 2018 / June /5 July 2018 →
  1. 1151
  2. 25
  3. 3 
  4. 4136
  5. 560
  6. 630
  7. 7237
  8. 896
  9. 91
  10. 101
  11. 11349
  12. 1256
  13. 1359
  14. 1471
  15. 1548
  16. 164
  17. 1726
  18. 1827
  19. 1948
  20. 2035
  21. 2141
  22. 2226
  23. 2310
  24. 244
  25. 2529
  26. 26144
  27. 2731
  28. 2820
  29. 2937
  30. 305
All Critical High Medium Low Exploited only Public exploit

22 results · Clear filters · Feed

  • Medium 6.5
    CVE-2018-1000198

    XML External Entity processing vulnerability in Jenkins Black Duck Hub Plugin

    A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read permission to make Jenkins process XML eternal entities in an XML document.

    com.blackducksoftware.integration:blackduck-hub Maven
  • Medium 5.4
    CVE-2018-1000202

    Jenkins Groovy Postbuild Plugin vulnerable to Cross-site Scripting

    A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser whe…

    org.jvnet.hudson.plugins:groovy-postbuild Maven
  • Medium 4.3
    CVE-2018-1000195

    Cross-Site Request Forgery in Jenkins

    A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether …

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2018-1000192

    Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

    A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read access to enumerate all installed plugins.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.5
    CVE-2018-1000196

    Jenkins Gitlab Hook Plugin stores and displays GitLab API token in plain text

    A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_notifier/global.erb that allows attackers with local Jenkins master file system access or control of a Jenkins administr…

    org.jenkins-ci.ruby-plugins:gitlab-hook Maven
  • Medium 4.3
    CVE-2018-1000193

    Injection in Jenkins

    A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have t…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.2
    CVE-2018-1000186

    Jenkins GitHub Pull Request Builder Plugin credential capture vulnerability

    A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified cre…

    org.jenkins-ci.plugins:ghprb Maven
  • Medium 5.4
    CVE-2018-1000184

    Jenkins GitHub Plugin server-side request forgery vulnerability exists

    A server-side request forgery vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubPluginConfig.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

    com.coravy.hudson.plugins.github:github Maven
  • Medium 6.5
    CVE-2018-1000191

    Jenkins Black Duck Detect Plugin information exposure vulnerability

    A exposure of sensitive information vulnerability exists in Jenkins Black Duck Detect Plugin 1.4.0 and older in DetectPostBuildStepDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified …

    com.synopsys.integration:synopsys-detect Maven
  • Medium 5.4
    CVE-2018-1000188

    Jenkins CAS Plugin Server-Side Request Forgery vulnerability

    A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

    org.jenkins-ci.plugins:cas-plugin Maven
  • Medium 6.4
    CVE-2018-1000182

    Server-Side Request Forgery in Jenkins Git Plugin

    A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2013GitRepositoryBrowser.java, ViewGitWeb.java that allows attackers with Overall/Read access to caus…

    git org.jenkins-ci.plugins:git Azure Linux Maven
  • Medium 6.5
    CVE-2018-1000187

    Exposure of Sensitive Information in Jenkins Kubernetes Plugin

    A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that results in sensitive variables such as passwords being written to logs.

    org.csanchez.jenkins.plugins:kubernetes Maven
  • Medium 4.3
    CVE-2018-1000185

    Jenkins GitHub Branch Source Plugin vulnerable to Server-Side Request Forgery

    A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

    org.jenkins-ci.plugins:github-branch-source Maven
  • Medium 6.5
    CVE-2018-1000183

    Jenkins GitHub Plugin exposure of sensitive information vulnerability exists

    A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtai…

    com.coravy.hudson.plugins.github:github Maven
  • Medium 6.5
    CVE-2018-1000190

    Exposure of sensitive information vulnerability in Jenkins Black Duck Hub Plugin

    A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentia…

    com.blackducksoftware.integration:blackduck-hub Maven
  • Medium 6.5
    CVE-2018-1332

    Moderate severity vulnerability that affects org.apache.storm:storm-core

    Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another user when communicating with some Storm Daemons.

    Apache Software Foundation Apache Storm org.apache.storm:storm-core Maven
  • Medium 5.5
    CVE-2018-8008

    ZipSlip in org.apache.storm:storm-core

    Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), …

    Apache Software Foundation Apache Storm org.apache.storm:storm-core Maven
  • Medium 6.1
    CVE-2018-1432

    IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to cross-frame scripting which is a vulnerabi…

    IBM InfoSphere Information Server
  • Medium 5.9
    CVE-2018-1454

    IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to obtain sensitive information, c…

    IBM InfoSphere Information Server
  • Medium 6.5
    CVE-2018-8924

    Cross-site scripting (XSS) vulnerability in Title Tootip in Synology Office before 3.0.3-2143 allows remote authenticat…

    Synology Office
  • Medium 6.5
    CVE-2018-8923

    Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology File Station before 1.1.4-0122 allows remote…

    Synology File Station
  • Medium 5.4
    CVE-2017-18286

    nZEDb Cross-site Scripting (XSS) in the 404 error page

    nZEDb v0.7.3.3 has XSS in the 404 error page.

    nzedb/nzedb Packagist