Archive
August 2018
Vulnerabilities first published in this month (UTC), newest first.
1,015 results · Feed
-
Low 3.1
An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manif…
-
High 7.8
A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too smal…
-
Medium 5.9
A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images. Due to a logic error …
-
Medium 6.5
A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to …
-
Low 3.3
An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.
-
Medium 4.4
openbuildservice allowed deleting packages via project links
openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.
-
Medium 6.0
delete package via link exploit in open buildservice
Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.
-
High 8.8
A memory corruption vulnerability exists in the ANI-parsing functionality of Computerinsel Photoline 20.54. A specially…
-
Unscored —
Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execut…
-
Unscored —
Insufficient Input Validation in Bleach module in INTEL Distribution for Python versions prior to IDP 2018 Update 2 all…
-
Unscored —
Escalation of privilege in Intel Saffron MemoryBase before version 11.4 potentially allows an authorized user of the Sa…
-
Unscored —
Escalation of privilege in Intel Saffron admin application before 11.4 allows an authenticated user to access unauthori…
-
High 8.8
A memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.54. A specially…
-
High 8.8
A memory corruption vulnerability exists in the PSD-parsing functionality of Computerinsel Photoline 20.54. A specially…
-
Unscored —
Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execut…
-
Unscored —
Escalation of privilege in Intel Saffron MemoryBase before 11.4 allows an authenticated user access to privileged infor…
-
Unscored —
Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execut…
-
Unscored —
Out-of-bounds read condition in older versions of some Intel Graphics Driver for Windows code branches allows local use…
-
Medium 5.3
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leadin…
-
High 7.2
It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects …
-
Medium 5.4
JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomple…
-
Medium 5.3
It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to i…
-
Medium 6.7CVE-2016-8641 Public exploit
A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary fi…
-
Low 3.3
An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in open…
-
Low 3.1
Jenkins SSH Agent Plugin exposes SSH private key password to users with permission to read the build log
An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH private key password to users with permission to read the build log.
-
Medium 6.5
Jenkins Agiletestware Pangolin Connector for TestRail Plugin CSRF vulnerability and missing permission checks
A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP re…
-
Medium 5.5
Exposure of sensitive information vulnerability
An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attackers with file system access to the Jenkins master to obtain the API secret key stored in this plugin's…
-
Low 3.1
Jenkins Resource Disposer Plugin allows attacker to stop tracking specified resource
A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop tracking a resource.
-
Medium 4.2
Jenkins SaltStack Plugin allows attackers to capture credentials with a known credentials ID stored in Jenkins
An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.
-
High 8.8
Exposure of Sensitive Information in Jenkins Kubernetes Plugin
An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.
-
Medium 6.5
Exposure of sensitive information in Anchore Container Image Scanner Jenkins Plugin
An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilder.java that allows attackers with Item/ExtendedRead permission or file system access to the Jenkins master to obtain …
-
Medium 5.4
Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin CSRF vulnerability and missing permission checks
An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, Nexus3ChoiceListProvider.java that allows attackers to…
-
High 7.4
Jenkins Inedo BuildMaster Plugin globally and unconditionally disabled SSL/TLS certificate validation
A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMasterApi.java that allows attackers to impersonate any service that Jenkins connects to.
-
Medium 4.3
Server-Side Request Forgery (SSRF) in Jenkins Confluence Publisher Plugin
A server-side request forgery vulnerability exists in Jenkins Confluence Publisher Plugin 2.0.1 and earlier in ConfluenceSite.java that allows attackers to have Jenkins submit login requests to an attacker-specified Confluence server URL with attacker specifi…
-
High 7.4
Jenkins Inedo ProGet Plugin globally and unconditionally disabled SSL/TLS certificate validation
A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that allows attackers to impersonate any service that Jenkins connects to.
-
High 8.8
Jenkins Accurev Plugin CSRF vulnerability and missing permission checks
An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.
-
Medium 6.5
Jenkins TraceTronic ECU-TEST Plugin server-side request forgery vulnerability
A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Jenkins send HTTP requests to an attacker-specified host.
-
High 7.4
Jenkins TraceTronic ECU-TEST Plugin Man in the middle vulnerability
A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java that allows attackers to impersonate any service that Jenkins connects to.
-
Low 3.3
Jenkins meliora-testlab Plugin allows attackers with file system access to Jenkins master to obtain API key
An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that allows attackers with file system access to the Jenkins master to obtain the API key stored in this plugin's configuratio…
-
Medium 4.2
Jenkins Publisher Over CIFS Plugin confused deputy vulnerability
A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials.