Skip to content
OpenAdvisories

Archive

9 January 2019

Vulnerabilities first published on this day (UTC), newest first.

← December 2018 2019 / January /9 February 2019 →
  1. 14
  2. 229
  3. 358
  4. 410
  5. 5 
  6. 6 
  7. 78
  8. 871
  9. 9196
  10. 1048
  11. 1158
  12. 124
  13. 139
  14. 1414
  15. 1560
  16. 16212
  17. 1712
  18. 18123
  19. 193
  20. 20 
  21. 214
  22. 2227
  23. 2330
  24. 24107
  25. 2513
  26. 263
  27. 272
  28. 2828
  29. 2934
  30. 3018
  31. 3129
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 7.8
    CVE-2018-1000410

    Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

    An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descriptor.java t…

    org.jenkins-ci.main:jenkins-core Maven
  • High 7.8
    CVE-2018-1000424

    Jenkins Artifactory Plugin stored old directly entered credentials unencrypted on disk

    An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the p…

    org.jenkins-ci.plugins:artifactory Maven
  • High 7.8
    CVE-2018-1000425

    Jenkins SonarQube Scanner Plugin stored server authentication token in plain text

    An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.

    org.jenkins-ci.plugins:sonar Maven
  • High 8.8
    CVE-2018-1000418

    Jenkins HipChat Plugin allows credential capture due to incorrect authorization

    An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to send test notifications to an attacker-specified HipChat server with attacker-specified creden…

    org.jvnet.hudson.plugins:hipchat Maven
  • High 7.8
    CVE-2018-1000423

    Jenkins Crowd 2 Integration Plugin stored credentials in plain text

    An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used …

    org.jenkins-ci.plugins:crowd2 Maven
  • High 8.1
    CVE-2018-1000414

    CSRF vulnerability in Config File Provider Plugin

    A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction.java that allows creating and editing configuration file definitions.

    org.jenkins-ci.plugins:config-file-provider Maven
  • High 8.1
    CVE-2018-1000417

    CSRF vulnerability in Email Extension Template Plugin

    A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.java that allows creating or removing templates.

    org.jenkins-ci.plugins:email-ext Maven
  • High 8.6
    CVE-2018-16202

    Path Traversal in cordova-plugin-ionic-webview

    Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0) allows remote attackers to access arbitrary files via unspecified vectors.

    npm cordova-plugin-ionic-webview cordova-plugin-ionic-webview npm
  • High 7.5
    CVE-2018-20679

    An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP serve…

    busybox busybox busybox Debian Ubuntu Alpine
  • High 7.5
    CVE-2019-5747

    An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP clie…

    busybox busybox busybox Debian Ubuntu Alpine
  • High 8.8
    CVE-2019-0542

    xterm vulnerable to remote code execution

    A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.

    https://xtermjs.org/ xterm.js xterm node-xterm Debian npm
  • High 7.5
    CVE-2019-3581

    McAfee Web Gateway denial of service attack due to Improper Input Validation

    Improper input validation in the proxy component of McAfee Web Gateway 7.8.2.0 and later allows remote attackers to cause a denial of service via a crafted HTTP request parameter.

    McAfee McAfee Web Gateway