Archive
30 April 2019
Vulnerabilities first published on this day (UTC), newest first.
12 results · Clear filters · Feed
-
Medium 6.5
Improper Input Validation in Apache Archiva
In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the…
-
Medium 6.5
Cross-site scripting in Apache Archiva
In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communicati…
-
Medium 6.5
An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer func…
-
Medium 6.1
Cross-site Scripting in NodeBB
Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
-
Medium 6.5
Jenkins SiteMonitor Plugin globally and unconditionally disables SSL/TLS certificate validation
Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM.
-
Medium 6.5
Missing permission check in Jenkins Static Analysis Utilities Plugin
A missing permission check in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers with Overall/Read permission to change the per-job default graph configuration for all us…
-
Medium 4.3
Missing permission check in Jenkins Ansible Tower Plugin
A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillTowerCredentialsIdItems method allowed attackers with Overall/Read permission to enumerate credentials ID of credentials st…
-
Medium 6.1
Jenkins Self-Organizing Swarm Plug-in Modules Plugin XXE vulnerability via UDP broadcast response
Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary…
-
Medium 4.3
Jenkins GitHub Authentication Plugin Cross-Site Request Forgery vulnerability
Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.
-
Medium 4.3
Jenkins Static Analysis Utilities Plugin is vulnerable to Cross-site request forgery vulnerability
A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers to change the per-job default graph configuration for all users.
-
Medium 6.5
Jenkins Koji Plugin globally and unconditionally disables SSL/TLS certificate validation
Jenkins Koji Plugin disables SSL/TLS and hostname verification globally for the Jenkins master JVM.
-
Medium 4.2
Jenkins Ansible Tower Plugin cross-site request forgery vulnerability
A cross-site request forgery vulnerability in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method allowed attackers permission to connect to an attacker-specified URL…