Archive
February 2019
Vulnerabilities first published in this month (UTC), newest first.
847 results · Feed
-
Unscored —
In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability…
-
Unscored —
An issue was discovered in SIDU 6.0. The dbs parameter of the conn.php page has a reflected Cross-site Scripting (XSS) …
-
Unscored —CVE-2019-7543 Scanner template
In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability.
-
Unscored —
An issue was discovered in SIDU 6.0. Because the database name is not strictly filtered, the attacker can insert a name…
-
Unscored —
An issue was discovered in MyWebSQL 3.7. The Add User function of the User Manager pages has a Stored Cross-site Script…
-
Unscored —
BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November…
-
Medium 5.4CVE-2018-16890 Public exploit
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling …
-
High 7.1CVE-2019-3822 EPSS 13%
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an…
-
Medium 4.3
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-…
-
Medium 6.3
A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could by…
-
Medium 4.8
It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actio…
-
Unscored —
The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a …
-
Unscored —
Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell …
-
Unscored —
Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restr…
-
Unscored —
Acquia Connector facilitates sending certain telemetry data to Acquia for the purposes of analysis. The module automate…
-
Unscored —
This module provides a field on user profiles which allows users to get a notification when their account logs in to th…
-
Medium 6.1
MODX Revolution allows XSS through extended user fields
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.
-
Medium 5.4
MODX vulnerability allows for XSS via user settings parameters
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.
-
Medium 6.1
MODX Revolution vulnerable to XSS attack through its User Photo field
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.
-
Medium 6.1
MODX Revolution allows XSS via document resources
MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs.
-
Medium 4.3
Cross-Site Request Forgery in Jenkins Git Plugin
A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record.
-
Medium 4.3
Jenkins OpenId Connect Authentication Plugin showed plain text client secret in configuration form
An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser …
-
High 8.8
Sandbox Bypass in Script Security Plugin
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script…
-
Medium 6.5
Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS
An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/j…
-
Medium 6.5
Jenkins Monitoring Plugin vulnerable to Denial of service vulnerability
A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master.
-
Medium 5.4
Cross-site Scripting in Jenkins Blue Ocean Plugin
An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/Expo…
-
Medium 5.3
Jenkins Job Import Plugin CSRF vulnerability
A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the impor…
-
Medium 6.5
Cross-Site Request Forgery in Jenkins Blue Ocean Plugin
A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-…
-
Medium 4.8
Jenkins Config File Provider Plugin XSS vulnerability
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaS…
-
Medium 4.3
Jenkins Kanboard Plugin vulnerable to Server-side request forgery (SSRF)
A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that allows attackers with Overall/Read permission to submit a GET request to an attacker-specified URL.
-
High 8.8
Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability
A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation…
-
High 8.8
Sandbox Bypass via CSRF in Jenkins Warnings Plugin
A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.
-
Critical 9.1
XXE vulnerability in Jenkins Job Import Plugin
An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server (Jenkins) queried…
-
Medium 4.3
GitHub Authentication Plugin showed plain text client secret in configuration form
An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g…
-
Medium 4.3
Jenkins Job Import Plugin vulnerable to exposure of sensitive information
An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalConfig.java, src/main/…
-
Medium 6.1
XSS vulnerability in Jenkins Warnings Next Generation Plugin
A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, sr…
-
High 8.8
Jenkins Groovy Plugin sandbox bypass vulnerability
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in …
-
Medium 5.9
GitHub Authentication Plugin session fixation vulnerability
An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
-
High 7.4
Jenkins Active Directory Plugin Improper certificate validation with StartTLS
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm…
-
Unscored —
Insufficient output sanitization in the Automic Web Interface (AWI), in CA Automic Workload Automation 12.0 to 12.2, al…