6 February 2019

10 results · Clear filters · Feed

• High 8.8
  CVE-2018-3973

  An exploitable out of bounds write exists in the CAL parsing functionality of Canvas Draw version 5.0.0. A specially cr…

  Talos ACD Systems
  Feb 6, 2019
• High 8.8
  CVE-2018-3980

  An exploitable out-of-bounds write exists in the TIFF-parsing functionality of Canvas Draw version 5.0.0. A specially c…

  Talos ACD Systems
  Feb 6, 2019
• High 8.8
  CVE-2018-3976

  An exploitable out-of-bounds write exists in the CALS Raster file format-parsing functionality of Canvas Draw version 5…

  Talos ACD Systems
  Feb 6, 2019
• High 7.8
  CVE-2019-7548

  SQLAlchemy is vulnerable to SQL Injection via group_by parameter

  SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.

  sqlalchemy sqlalchemy sqlalchemy Debian Ubuntu PyPI
  Feb 6, 2019
• High 7.1
  CVE-2019-3822 EPSS 13%

  libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an…

  The curl Project curl curl curl Debian Ubuntu Alpine
  Feb 6, 2019
• High 8.8
  CVE-2019-1003005 Public exploit EPSS 20%

  Sandbox Bypass in Script Security Plugin

  A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Feb 6, 2019
• High 8.8
  CVE-2019-1003008

  Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability

  A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation…

  Jenkins Project Jenkins Warnings Next Generation Plugin io.jenkins.plugins:warnings-ng Web / CMS Maven
  Feb 6, 2019
• High 8.8
  CVE-2019-1003007

  Sandbox Bypass via CSRF in Jenkins Warnings Plugin

  A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.

  Jenkins Project Jenkins Warnings Plugin org.jvnet.hudson.plugins:warnings Web / CMS Maven
  Feb 6, 2019
• High 8.8
  CVE-2019-1003006

  Jenkins Groovy Plugin sandbox bypass vulnerability

  A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in …

  Jenkins Project Jenkins Groovy Plugin org.jenkins-ci.plugins:groovy Web / CMS Maven
  Feb 6, 2019
• High 7.4
  CVE-2019-1003009

  Jenkins Active Directory Plugin Improper certificate validation with StartTLS

  An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm…

  Jenkins Project Jenkins Active Directory Plugin org.jenkins-ci.plugins:active-directory Web / CMS Maven
  Feb 6, 2019