Archive
11 July 2019
Vulnerabilities first published on this day (UTC), newest first.
19 results · Clear filters · Feed
-
Medium 5.3
IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used …
-
Medium 4.3
IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file …
-
Medium 5.3
IBM Application Performance Management (IBM Monitoring 8.1.4) could allow a remote attacker to induce the application t…
-
Medium 4.4
IBM Multicloud Manager 3.1.0, 3.1.1, and 3.1.2 ibm-mcm-chart could allow a local attacker with admin privileges to obta…
-
Medium 5.9
IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters. This may lead to info…
-
Medium 6.5
Junos OS: EX4300 Series: Denial of Service upon receipt of large number of specific valid packets on management interface.
A vulnerability in the pfe-chassisd Chassis Manager (CMLC) daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the EX4300 when specific valid broadcast packets create a broadcast storm condition when received on the me…
-
Medium 5.8
EX4300 Series: When a firewall filter is applied to a loopback interface, other firewall filters for multicast traffic may fail
On EX4300 Series switches with TCAM optimization enabled, incoming multicast traffic matches an implicit loopback filter rule first, since it has high priority. This rule is meant for reserved multicast addresses 224.0.0.x, but incorrectly matches on 224.x.x.…
-
Medium 6.1
Gitea XSS Vulnerability in Repository Description
Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and…
-
Medium 5.9
Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficientl…
-
Medium 4.6
A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3…
-
Medium 6.5
UAA SQL Identity Zone Vulnerability
Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private i…
-
Medium 4.3
Missing permission check in Jenkins Docker Plugin
A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
-
Medium 4.3
Jenkins Caliper CI Plugin stores credentials in plain text
Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Port Allocator Plugin stores credentials in plain text
Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 6.5
Missing permission check in Jenkins Docker Plugin
A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another…
-
Medium 5.4CVE-2019-10349 Public exploit
Jenkins Dependency Graph Viewer Plugin contains Cross-site Scripting
A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
-
Medium 6.1
Jenkins Embeddable Build Status Plugin contains Cross-site Scripting
A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin.
-
Medium 4.3
Jenkins Gogs Plugin stored credentials in plain text
Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 6.1
Cross-Site Scripting in @nuxt/devalue
@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS.