Skip to content
OpenAdvisories

Archive

28 March 2019

Vulnerabilities first published on this day (UTC), newest first.

← February 2019 2019 / March /28 April 2019 →
  1. 111
  2. 22
  3. 32
  4. 411
  5. 578
  6. 6115
  7. 765
  8. 841
  9. 916
  10. 101
  11. 1138
  12. 1234
  13. 1331
  14. 1484
  15. 1539
  16. 1610
  17. 1795
  18. 1825
  19. 1949
  20. 2044
  21. 2153
  22. 2218
  23. 237
  24. 2426
  25. 2563
  26. 2660
  27. 2775
  28. 2860
  29. 2922
  30. 3017
  31. 314
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Medium 6.1
    CVE-2019-0224

    Moderate severity vulnerability that affects org.apache.jspwiki:jspwiki-main

    In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on i…

    Apache Apache JSPWiki org.apache.jspwiki:jspwiki-main Maven
  • Medium 6.5
    CVE-2019-1003045

    ECS Publisher Plugin stored and displayed API token in plain text

    A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenkins home directory to obtain the API token configured in this plugin's configuration.

    Jenkins Project Jenkins ECS Publisher Plugin de.eacg:ecs-publisher Web / CMS Maven
  • Medium 4.2
    CVE-2019-1003043

    Jenkins Slack Notification Plugin missing permission check

    A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credenti…

    Jenkins Project Jenkins Slack Notification Plugin org.jenkins-ci.plugins:slack Web / CMS Maven
  • Medium 5.4
    CVE-2019-1003042

    Jenkins Lockable Resources Plugin XSS vulnerability

    A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.

    Jenkins Project Jenkins Lockable Resources Plugin org.6wind.jenkins:lockable-resources Web / CMS Maven
  • Medium 6.5
    CVE-2019-1003047

    SSRF vulnerability due to missing permission check in Fortify on Demand Uploader Plugin

    A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

    Jenkins Project Jenkins Fortify on Demand Uploader Plugin org.jenkins-ci.plugins:fortify-on-demand-uploader Web / CMS Maven
  • Medium 6.5
    CVE-2019-1003046

    Jenkins Fortify on Demand Uploader Plugin CSRF vulnerability

    A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an attacker-specified server.

    Jenkins Project Jenkins Fortify on Demand Uploader Plugin org.jenkins-ci.plugins:fortify-on-demand-uploader Web / CMS Maven
  • Medium 6.1
    CVE-2019-10260

    Moderate severity vulnerability that affects total.js

    Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).

    total.js npm
  • Medium 6.1
    CVE-2019-10255

    Open Redirect vulnerability in jupyterhub and notebook

    An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers run…

    notebook jupyter-notebook jupyter-notebook jupyterhub Debian Ubuntu PyPI
  • Medium 4.4
    CVE-2019-1762

    Cisco IOS and IOS XE Software Information Disclosure Vulnerability

    A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensitive system information on an affected device. The vulnerability is due to improper memory operations performed at encry…

    Cisco Cisco IOS and IOS-XE Software iOS Network devices
  • Medium 5.3
    CVE-2019-1759 Public exploit

    Cisco IOS XE Software Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability

    A vulnerability in access control list (ACL) functionality of the Gigabit Ethernet Management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the Gigabit Ethernet Management interface.…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.8
    CVE-2019-1760

    Cisco IOS XE Software Performance Routing Version 3 Denial of Service Vulnerability

    A vulnerability in Performance Routing Version 3 (PfRv3) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the affected device to reload. The vulnerability is due to the processing of malformed smart probe packets. An attacker …

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 4.3
    CVE-2019-1761

    Cisco IOS and IOS XE Software Hot Standby Router Protocol Information Leak Vulnerability

    A vulnerability in the Hot Standby Router Protocol (HSRP) subsystem of Cisco IOS and IOS XE Software could allow an unauthenticated, adjacent attacker to receive potentially sensitive information from an affected device. The vulnerability is due to insufficie…

    Cisco Cisco IOS and IOS-XE Software iOS Network devices
  • Medium 4.7
    CVE-2019-1758

    Cisco IOS Software Catalyst 6500 Series 802.1x Authentication Bypass Vulnerability

    A vulnerability in 802.1x function of Cisco IOS Software on the Catalyst 6500 Series Switches could allow an unauthenticated, adjacent attacker to access the network prior to authentication. The vulnerability is due to how the 802.1x packets are handled in th…

    Cisco Cisco IOS Software iOS Network devices
  • Medium 6.5
    CVE-2019-1755

    Cisco IOS XE Software Command Injection Vulnerability

    A vulnerability in the Web Services Management Agent (WSMA) function of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary Cisco IOS commands as a privilege level 15 user. The vulnerability occurs because the affected sof…

    Cisco Cisco IOS XE Software iOS Network devices