Skip to content
OpenAdvisories

Archive

9 January 2019

Vulnerabilities first published on this day (UTC), newest first.

← December 2018 2019 / January /9 February 2019 →
  1. 14
  2. 229
  3. 358
  4. 410
  5. 5 
  6. 6 
  7. 78
  8. 871
  9. 9196
  10. 1048
  11. 1158
  12. 124
  13. 139
  14. 1414
  15. 1560
  16. 16212
  17. 1712
  18. 18123
  19. 193
  20. 20 
  21. 214
  22. 2227
  23. 2330
  24. 24107
  25. 2513
  26. 263
  27. 272
  28. 2828
  29. 2934
  30. 3018
  31. 3129
All Critical High Medium Low Exploited only Public exploit

20 results · Clear filters · Feed

  • Medium 6.5
    CVE-2018-1000422

    Jenkins Crowd 2 Integration Plugin server-side request forgery vulnerability

    An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have Jenkins perform a connection test, connecting to an attacker-specified server with attacker-specifi…

    org.jenkins-ci.plugins:crowd2 Maven
  • Medium 6.5
    CVE-2018-1000411

    Jenkins JUnit Plugin CSRF vulnerability

    A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.

    org.jenkins-ci.plugins:junit Maven
  • Medium 6.5
    CVE-2018-1000420

    Improper authorization vulnerability in Jenkins Mesos Plugin

    An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.

    org.jenkins-ci.plugins:mesos Maven
  • Medium 6.1
    CVE-2018-1000426

    Stored XSS vulnerability in Jenkins Git Changelog Plugin

    A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, GitLogBasicChangelogPostPubl…

    de.wellnerbou.jenkins:git-changelog Maven
  • Medium 6.5
    CVE-2018-1000421

    Server-side request forgery vulnerability in Jenkins Mesos Plugin

    An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to initiate a test connection to an attacker-specified Mesos server with attacker-specified credentials…

    org.jenkins-ci.plugins:mesos Maven
  • Medium 6.5
    CVE-2018-1000408

    Improper Authorization in Jenkins

    A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that allows attackers without Overall/Read permission to access a specific URL on instances us…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.1
    CVE-2018-1000407

    Cross-site Scripting in Jenkins

    A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenki…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.5
    CVE-2018-1000419

    Jenkins HipChat Plugin allows attackers with Overall/Read access to obtain credential IDs

    An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.

    org.jvnet.hudson.plugins:hipchat Maven
  • Medium 6.5
    CVE-2018-1000406

    Path Traversal in Jenkins

    A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that allows attackers with Job/Configure permission to define a file parameter with a file name outside the …

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 5.4
    CVE-2018-1000415

    Cross-site Scripting in Jenkins Rebuilder Plugin

    A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in RebuildAction/BooleanParameterValue.jelly, RebuildAction/ExtendedChoiceParameterValue.jelly, RebuildAction/FileParameterValue.jelly, RebuildAction/LabelParameterValue.…

    com.sonyericsson.hudson.plugins.rebuild:rebuild Maven
  • Medium 5.4
    CVE-2018-1000413

    Stored XSS vulnerability in Config File Provider Plugin

    A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.

    org.jenkins-ci.plugins:config-file-provider Maven
  • Medium 4.2
    CVE-2018-1000412

    Jenkins Jira Plugin Incorrect Authorization vulnerability

    An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained thro…

    org.jenkins-ci.plugins:jira Maven
  • Medium 5.4
    CVE-2018-1000409

    Session Fixation in Jenkins

    A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that prevented Jenkins from invalidating the existing session and creating a new one when a use…

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.1
    CVE-2018-1000416

    Jenkins Job Config History Plugin reflected XSS vulnerability

    A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-specified HTML in Jenkins to users with Job/Configure access.

    org.jenkins-ci.plugins:jobConfigHistory Maven
  • Medium 5.4
    CVE-2018-20682

    Fork CMS XSS Vulnerability

    Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).

    forkcms/forkcms Packagist
  • Medium 6.1
    CVE-2018-16191

    EC-CUBE Open redirect vulnerability

    Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC…

    LOCKON EC-CUBE ec-cube/ec-cube Packagist
  • Medium 6.5
    CVE-2019-3498

    Improper Input Validation in Django

    In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 6.1
    CVE-2018-20676

    XSS vulnerability that affects bootstrap

    In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

    twitter-bootstrap3 bootstrap twitter-bootstrap3 org.webjars:bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems
  • Medium 6.1
    CVE-2018-20677

    bootstrap Cross-site Scripting vulnerability

    In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

    ceph fluent-bit pytorch twitter-bootstrap3 Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems
  • Medium 6.1
    CVE-2016-10735 Public exploit

    Bootstrap Cross-site Scripting vulnerability

    In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

    bootstrap twitter-bootstrap3 twitter-bootstrap3 twbs/bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems