22 January 2019

6 results · Clear filters · Feed

• High 8.0
  CVE-2019-6338

  third-party PEAR Archive_Tar library updates

  In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-100088…

  Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  Jan 22, 2019
• High 8.8
  CVE-2019-1003002 Public exploit EPSS 81%

  Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability

  A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to p…

  Jenkins Project Pipeline: Declarative Plugin org.jenkinsci.plugins:pipeline-model-definition Maven
  Jan 22, 2019
• High 8.8
  CVE-2019-1003001 Public exploit EPSS 86%

  Jenkins Groovy Plugin sandbox bypass vulnerability

  A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers wit…

  Jenkins Project Pipeline: Groovy Plugin org.jenkins-ci.plugins:script-security org.jenkins-ci.plugins.workflow:workflow-cps-parent Maven
  Jan 22, 2019
• High 7.2
  CVE-2019-1003003

  Improper Authorization in Jenkins Core

  An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 22, 2019
• High 8.8
  CVE-2019-1003000 Public exploit Scanner template EPSS 98%

  Protection Mechanism Failure in Jenkins Script Security Plugin

  A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary c…

  Jenkins Project Script Security Plugin org.jenkins-ci.plugins:script-security Maven
  Jan 22, 2019
• High 7.2
  CVE-2019-1003004

  Improper Authorization in Jenkins Core

  An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely e…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 22, 2019