Archive
March 2019
Vulnerabilities first published in this month (UTC), newest first.
14 results · Clear filters · Feed
-
Low 3.3
Jenkins PRQA Plugin stored password in plain text
A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtain the unencrypted password from the plugin configuration.
-
Low 3.7
Twig Sandbox Information Disclosure
A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.
-
Low 3.3
It was discovered the fix for CVE-2018-19758 (libsndfile) was not complete and still allows a read beyond the limits of…
-
Low 2.9
Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while i…
-
Low 2.9
EasyLobby Solo could allow a local attacker to obtain sensitive information, caused by the storing of the social securi…
-
Low 2.9
Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, …
-
Low 2.9
Lobby Track Desktop could allow a local attacker to bypass security restrictions, caused by an error in the find visito…
-
Low 2.9
Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, …
-
Low 3.3
Password exposed in process listing
In yast2-samba-provision up to and including version 1.0.1 the password for samba shares was provided on the command line to tools used by yast2-samba-provision, allowing local attackers to read them in the process list
-
Low 2.2
Static tempfile name allows overwriting of arbitrary files
In yast2-multipath before version 4.1.1 a static temporary filename allows local attackers to overwrite files on systems without symlink protection
-
Low 3.1
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information w…
-
Low 3.3
Jenkins Repository Connector Plugin has insufficiently protected credentials
An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnect…
-
Low 2.2
User can overwrite arbitrary log files in support tar
In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files.
-
Low 2.8
Static temporary filename allows overwriting of files
Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection