Skip to content
OpenAdvisories

Archive

23 July 2018

Vulnerabilities first published on this day (UTC), newest first.

← June 2018 2018 / July /23 August 2018 →
  1. 18
  2. 266
  3. 3113
  4. 416
  5. 5133
  6. 696
  7. 78
  8. 89
  9. 9431
  10. 1087
  11. 1198
  12. 1235
  13. 1386
  14. 14 
  15. 1512
  16. 1644
  17. 1732
  18. 18253
  19. 1956
  20. 20157
  21. 211
  22. 223
  23. 2361
  24. 2449
  25. 2533
  26. 2644
  27. 2777
  28. 289
  29. 2910
  30. 3014
  31. 31129
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 6.1
    CVE-2018-8031

    Apache TomEE console vulnerable to Cross-site Scripting

    The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not s…

    Apache Software Foundation Apache TomEE org.apache.tomee:tomee-webapp Maven
  • Medium 4.4
    CVE-2018-10912

    Moderate severity vulnerability that affects org.keycloak:keycloak-core

    keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw…

    [UNKNOWN] keycloak org.keycloak:keycloak-core Maven
  • Medium 5.4
    CVE-2018-1999005

    Improper Neutralization of Input During Web Page Generation in Jenkins

    A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidget/control.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in ano…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2018-1999003

    Incorrect Authorization in Jenkins

    A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permission to cancel queued builds.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2018-1999006

    Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

    A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackers to determine the date and time when a plugin HPI/JPI file was last extracted, which typically is the date of the mo…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 5.4
    CVE-2018-1999007

    Cross-site scripting vulnerability exists in Jenkins and Stapler Plugin

    A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins to define Jav…

    org.jenkins-ci.main:jenkins-core org.kohsuke.stapler:stapler-parent Maven
  • Medium 4.3
    CVE-2018-1999004

    Incorrect Authorization in Jenkins

    A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 5.4
    CVE-2018-1999024

    Macro in MathJax running untrusted Javascript within a web browser

    MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view …

    numpy mathjax mathjax mathjax Debian Ubuntu Azure Linux npm
  • Medium 5.4
    CVE-2018-1999021

    Gleez Cms Cross-site Scripting in Profile Page

    Gleezcms Gleez Cms version 1.3.0 contains a Cross Site Scripting (XSS) vulnerability in Profile page that can result in Inject arbitrary web script or HTML via the profile page editor. This attack appear to be exploitable via The victim must navigate to the a…

    gleez/cms Packagist
  • Medium 4.3
    CVE-2018-1503

    IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a remotely authenticated attacker to to send invalid or malformed header…

    IBM WebSphere MQ
  • Medium 5.4
    CVE-2018-1513 Public exploit

    IBM Sterling B2B Integrator Standard Edition 5.2.0 through 5.2.6 is vulnerable to cross-site scripting. This vulnerabil…

    IBM Sterling B2B Integrator