Archive

6 February 2019

Vulnerabilities first published on this day (UTC), newest first.

← January 2019 2019 / February /6 March 2019 →

All Critical High Medium Low Exploited only Public exploit

53 results · Feed

Medium 6.5

CVE-2019-1003012

Cross-Site Request Forgery in Jenkins Blue Ocean Plugin

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-…

Jenkins Project Jenkins Blue Ocean Plugins io.jenkins.blueocean:blueocean Web / CMS Maven

Feb 6, 2019
Medium 4.8

CVE-2019-1003014

Jenkins Config File Provider Plugin XSS vulnerability

An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaS…

Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven

Feb 6, 2019
Medium 4.3

CVE-2019-1003020

Jenkins Kanboard Plugin vulnerable to Server-side request forgery (SSRF)

A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that allows attackers with Overall/Read permission to submit a GET request to an attacker-specified URL.

Jenkins Project Jenkins Kanboard Plugin org.jenkins-ci.plugins:kanboard Web / CMS Maven

Feb 6, 2019
High 8.8

CVE-2019-1003008

Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability

A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation…

Jenkins Project Jenkins Warnings Next Generation Plugin io.jenkins.plugins:warnings-ng Web / CMS Maven

Feb 6, 2019
High 8.8

CVE-2019-1003007

Sandbox Bypass via CSRF in Jenkins Warnings Plugin

A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.

Jenkins Project Jenkins Warnings Plugin org.jvnet.hudson.plugins:warnings Web / CMS Maven

Feb 6, 2019
Critical 9.1

CVE-2019-1003015

XXE vulnerability in Jenkins Job Import Plugin

An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server (Jenkins) queried…

Jenkins Project Jenkins Job Import Plugin org.jenkins-ci.plugins:job-import-plugin Web / CMS Maven

Feb 6, 2019
Medium 4.3

CVE-2019-1003018

GitHub Authentication Plugin showed plain text client secret in configuration form

An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g…

Jenkins Project Jenkins GitHub Authentication Plugin org.jenkins-ci.plugins:github-oauth Web / CMS Maven

Feb 6, 2019
Medium 4.3

CVE-2019-1003016

Jenkins Job Import Plugin vulnerable to exposure of sensitive information

An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalConfig.java, src/main/…

Jenkins Project Jenkins Job Import Plugin org.jenkins-ci.plugins:job-import-plugin Web / CMS Maven

Feb 6, 2019
Medium 6.1

CVE-2019-1003023

XSS vulnerability in Jenkins Warnings Next Generation Plugin

A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, sr…

Jenkins Project Jenkins Warnings Next Generation Plugin io.jenkins.plugins:warnings-ng Web / CMS Maven

Feb 6, 2019
High 8.8

CVE-2019-1003006

Jenkins Groovy Plugin sandbox bypass vulnerability

A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in …

Jenkins Project Jenkins Groovy Plugin org.jenkins-ci.plugins:groovy Web / CMS Maven

Feb 6, 2019
Medium 5.9

CVE-2019-1003019

GitHub Authentication Plugin session fixation vulnerability

An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.

Jenkins Project Jenkins GitHub Authentication Plugin org.jenkins-ci.plugins:github-oauth Web / CMS Maven

Feb 6, 2019
High 7.4

CVE-2019-1003009

Jenkins Active Directory Plugin Improper certificate validation with StartTLS

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm…

Jenkins Project Jenkins Active Directory Plugin org.jenkins-ci.plugins:active-directory Web / CMS Maven

Feb 6, 2019
Unscored —

CVE-2019-6504

Insufficient output sanitization in the Automic Web Interface (AWI), in CA Automic Workload Automation 12.0 to 12.2, al…

CA Technologies, A Broadcom Company CA Automic Workload Automation

Feb 6, 2019