Archive
26 June 2018
Vulnerabilities first published on this day (UTC), newest first.
144 results · Feed
-
Medium 6.6
iSM: Dell EMC iDRAC Service Module Improper File Permission Vulnerability
Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission of the hosts file of the host operating system (/etc/hosts) to world writable. A malicious low privi…
-
Unscored —
In Easy Magazine through 2012-10-26, there is XSS in the search bar of the web site.
-
Unscored —CVE-2018-12900 EPSS 25%
Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, …
-
Unscored —
In CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603, there is persistent XSS via an account name on…
-
Medium 5.3
A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x67). The vulnerability is pr…
-
Medium 5.3
A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x69). The vulnerability is pr…
-
Medium 5.3
An IBM WebSphere MQ (Maintenance levels 7.1.0.0 - 7.1.0.9, 7.5.0.0 - 7.5.0.8, 8.0.0.0 - 8.0.0.8, 9.0.0.0 - 9.0.0.2, and…
-
Medium 5.8
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using malformed SAML responses from the SAML identity provider …
-
Unscored —
WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin…
-
Unscored —
Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVP…
-
Unscored —
An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, u…
-
Unscored —
An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases,…
-
High 7.5
Sprockets path traversal leads to information leak
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root di…
-
Unscored —
A vulnerability has been identified in SCALANCE M875 (All versions). The web interface on port 443/tcp could allow a st…
-
Unscored —
A vulnerability has been identified in SCALANCE M875 (All versions). The web interface on port 443/tcp could allow a Cr…
-
Unscored —
A vulnerability has been identified in SCALANCE M875 (All versions). An attacker with access to the local file system m…
-
Medium 5.0
ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup …
-
Unscored —
A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to th…
-
Unscored —
A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All ver…
-
Unscored —
A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All ver…
-
Unscored —
A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to th…
-
Unscored —
A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to th…
-
Unscored —
There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (…
-
Unscored —
An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface.
-
Unscored —
An issue was discovered in multiple models of Axis IP Cameras. There is an Incorrect Size Calculation.
-
Unscored —
There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to c…
-
Unscored —
An issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption.
-
Unscored —
An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control.
-
Unscored —
An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.
-
High 8.8
Jenkins Configuration as Code Plugin has Insufficiently Protected Credentials
A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkin…
-
High 8.8
CSRF vulnerability and missing permission checks in Openstack Cloud Plugin allowed capturing credentials
A exposure of sensitive information vulnerability exists in Jenkins Openstack Cloud Plugin 2.35 and earlier in BootSource.java, InstancesToRun.java, JCloudsCleanupThread.java, JCloudsCloud.java, JCloudsComputer.java, JCloudsPreCreationThread.java, JCloudsRete…
-
Medium 6.5
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins SSH Credentials Plugin
A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenk…
-
Medium 6.5
Jenkins SAML Plugin Session Fixation vulnerability
A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the pre-authentication session.
-
Medium 6.5
Arbitrary file write vulnerability in Jenkins Fortify CloudScan Plugin
A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the…
-
Medium 6.5
Jenkins Configuration as Code Plugin vulnerable to Exposure of Sensitive Information
A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration.
-
Medium 6.5
Jenkins CollabNet Plugin man in the middle vulnerability
A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java that allows attackers to impersonate any service that Jenkins connects to.
-
Low 3.3
Jenkins z/OS Connector Plugin allows local attacker to retrieve configured password
A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) …
-
Medium 6.5
URLTrigger Plugin server-side request forgery vulnerability
A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.
-
Medium 5.4
Jenkins Badge Plugin cross-site scripting vulnerability
A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows attackers able to control build badge content to define JavaScript that would be executed in another use…
-
High 8.8
CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials
A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another met…