Skip to content
OpenAdvisories

Archive

10 December 2018

Vulnerabilities first published on this day (UTC), newest first.

← November 2018 2018 / December /10 January 2019 →
  1. 18
  2. 21
  3. 354
  4. 480
  5. 530
  6. 675
  7. 757
  8. 88
  9. 93
  10. 1032
  11. 1153
  12. 1281
  13. 1356
  14. 1421
  15. 152
  16. 16 
  17. 1778
  18. 1819
  19. 1931
  20. 20136
  21. 2130
  22. 2214
  23. 2340
  24. 2441
  25. 2526
  26. 2633
  27. 2711
  28. 2882
  29. 29 
  30. 3029
  31. 3134
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.5
    CVE-2018-1279

    RabbitMQ cluster compromise due to deterministically generated cookie

    Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, i…

    Pivotal RabbitMQ for PCF rabbitmq-server rabbitmq-server Debian Ubuntu
  • High 8.1
    CVE-2018-15800

    Timing attack allows extraction of signing key in Bits Service

    Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key, allowing them complete read and write access to the the Bits Service st…

    Cloud Foundry bits-service-release
  • High 8.2
    CVE-2018-1000863

    Improper Limitation of a Pathname to a Restricted Directory in Jenkins

    A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially pr…

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.8
    CVE-2018-1000866

    Jenkins Script Security and Pipeline Groovy Plugins Sandbox Bypass

    A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows …

    org.jenkins-ci.plugins:script-security org.jenkins-ci.plugins.workflow:workflow-cps Maven
  • High 8.8
    CVE-2018-1000865

    Improper Privilege Management in Jenkins

    A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins ma…

    org.jenkins-ci.plugins:script-security Maven
  • High 7.5
    CVE-2018-20000

    Improper Restriction of XML External Entity Reference in bedework:bw-webdav

    Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.

    org.bedework:bw-webdav Maven