Skip to content
OpenAdvisories

Archive

9 January 2019

Vulnerabilities first published on this day (UTC), newest first.

← December 2018 2019 / January /9 February 2019 →
  1. 14
  2. 229
  3. 358
  4. 410
  5. 5 
  6. 6 
  7. 78
  8. 871
  9. 9196
  10. 1048
  11. 1158
  12. 124
  13. 139
  14. 1414
  15. 1560
  16. 16212
  17. 1712
  18. 18123
  19. 193
  20. 20 
  21. 214
  22. 2227
  23. 2330
  24. 24107
  25. 2513
  26. 263
  27. 272
  28. 2828
  29. 2934
  30. 3018
  31. 3129
All Critical High Medium Low Exploited only Public exploit

196 results · Feed

  • Medium 6.5
    CVE-2018-1000422

    Jenkins Crowd 2 Integration Plugin server-side request forgery vulnerability

    An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have Jenkins perform a connection test, connecting to an attacker-specified server with attacker-specifi…

    org.jenkins-ci.plugins:crowd2 Maven
  • Medium 6.5
    CVE-2018-1000411

    Jenkins JUnit Plugin CSRF vulnerability

    A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.

    org.jenkins-ci.plugins:junit Maven
  • Medium 6.5
    CVE-2018-1000420

    Improper authorization vulnerability in Jenkins Mesos Plugin

    An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.

    org.jenkins-ci.plugins:mesos Maven
  • High 7.8
    CVE-2018-1000410

    Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

    An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descriptor.java t…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.1
    CVE-2018-1000426

    Stored XSS vulnerability in Jenkins Git Changelog Plugin

    A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, GitLogBasicChangelogPostPubl…

    de.wellnerbou.jenkins:git-changelog Maven
  • Medium 6.5
    CVE-2018-1000421

    Server-side request forgery vulnerability in Jenkins Mesos Plugin

    An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to initiate a test connection to an attacker-specified Mesos server with attacker-specified credentials…

    org.jenkins-ci.plugins:mesos Maven
  • Medium 6.5
    CVE-2018-1000408

    Improper Authorization in Jenkins

    A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that allows attackers without Overall/Read permission to access a specific URL on instances us…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.1
    CVE-2018-1000407

    Cross-site Scripting in Jenkins

    A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenki…

    org.jenkins-ci.main:jenkins-core Maven
  • High 7.8
    CVE-2018-1000424

    Jenkins Artifactory Plugin stored old directly entered credentials unencrypted on disk

    An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the p…

    org.jenkins-ci.plugins:artifactory Maven
  • Medium 6.5
    CVE-2018-1000419

    Jenkins HipChat Plugin allows attackers with Overall/Read access to obtain credential IDs

    An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.

    org.jvnet.hudson.plugins:hipchat Maven
  • High 7.8
    CVE-2018-1000425

    Jenkins SonarQube Scanner Plugin stored server authentication token in plain text

    An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.

    org.jenkins-ci.plugins:sonar Maven
  • Medium 6.5
    CVE-2018-1000406

    Path Traversal in Jenkins

    A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that allows attackers with Job/Configure permission to define a file parameter with a file name outside the …

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.8
    CVE-2018-1000418

    Jenkins HipChat Plugin allows credential capture due to incorrect authorization

    An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to send test notifications to an attacker-specified HipChat server with attacker-specified creden…

    org.jvnet.hudson.plugins:hipchat Maven
  • High 7.8
    CVE-2018-1000423

    Jenkins Crowd 2 Integration Plugin stored credentials in plain text

    An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used …

    org.jenkins-ci.plugins:crowd2 Maven
  • Medium 5.4
    CVE-2018-1000415

    Cross-site Scripting in Jenkins Rebuilder Plugin

    A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in RebuildAction/BooleanParameterValue.jelly, RebuildAction/ExtendedChoiceParameterValue.jelly, RebuildAction/FileParameterValue.jelly, RebuildAction/LabelParameterValue.…

    com.sonyericsson.hudson.plugins.rebuild:rebuild Maven
  • High 8.1
    CVE-2018-1000414

    CSRF vulnerability in Config File Provider Plugin

    A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction.java that allows creating and editing configuration file definitions.

    org.jenkins-ci.plugins:config-file-provider Maven
  • Medium 5.4
    CVE-2018-1000413

    Stored XSS vulnerability in Config File Provider Plugin

    A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.

    org.jenkins-ci.plugins:config-file-provider Maven
  • High 8.1
    CVE-2018-1000417

    CSRF vulnerability in Email Extension Template Plugin

    A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.java that allows creating or removing templates.

    org.jenkins-ci.plugins:email-ext Maven
  • Medium 4.2
    CVE-2018-1000412

    Jenkins Jira Plugin Incorrect Authorization vulnerability

    An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained thro…

    org.jenkins-ci.plugins:jira Maven
  • Medium 5.4
    CVE-2018-1000409

    Session Fixation in Jenkins

    A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that prevented Jenkins from invalidating the existing session and creating a new one when a use…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.1
    CVE-2018-1000416

    Jenkins Job Config History Plugin reflected XSS vulnerability

    A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-specified HTML in Jenkins to users with Job/Configure access.

    org.jenkins-ci.plugins:jobConfigHistory Maven
  • Medium 5.4
    CVE-2018-20682

    Fork CMS XSS Vulnerability

    Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).

    forkcms/forkcms Packagist
  • Unscored —
    CVE-2018-20681

    mate-screensaver before 1.20.2 in MATE Desktop Environment allows physically proximate attackers to view screen content…

    mate-screensaver mate-screensaver Debian Ubuntu
  • Unscored —
    CVE-2016-10736

    The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?pa…

  • Unscored —
    CVE-2018-0631

    Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via target…

    NEC Aterm W300P
  • Unscored —
    CVE-2018-0669

    INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the …

    MICRONET INplc-RT
  • Unscored —
    CVE-2018-0677

    BN-SDWBP3 firmware version 1.0.9 and earlier allows attacker with administrator rights on the same network segment to e…

    panasonic BN-SDWBP3
  • Unscored —
    CVE-2018-0636

    Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via Facto…

    NEC HC100RC
  • Unscored —
    CVE-2018-0641

    Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary co…

    NEC HC100RC
  • Unscored —
    CVE-2018-0665

    Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Re…

    Yamaha NIPPON TELEGRAPH AND TELEPHONE WEST NIPPON TELEGRAPH AND TELEPHONE EAST Yamaha Broadband VoIP Router RT57i
  • Unscored —
    CVE-2018-0667

    Untrusted search path vulnerability in Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ …

    MICRONET Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier
  • Unscored —
    CVE-2018-0703

    Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files v…

    Cybozu Cybozu Office
  • Unscored —
    CVE-2018-0640

    Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary co…

    NEC HC100RC
  • Unscored —
    CVE-2018-0670

    INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the …

    MICRONET INplc-RT
  • Unscored —
    CVE-2018-0639

    Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via tools…

    NEC HC100RC
  • Unscored —
    CVE-2018-0689

    HTTP header injection vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2…

    Seiko Epson SEIKO EPSON printers and scanners
  • Unscored —
    CVE-2018-0626

    Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS command…

    NEC WG1200HP
  • Unscored —
    CVE-2018-0678

    Buffer overflow in BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to execu…

    panasonic BN-SDWBP3
  • Unscored —
    CVE-2018-0705

    Directory traversal vulnerability in Cybozu Dezie 8.0.2 to 8.1.2 allows remote attackers to read arbitrary files via HT…

    Cybozu Cybozu Dezie
  • Unscored —
    CVE-2018-0628

    Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS command…

    NEC WG1200HP