Archive
September 2019
Vulnerabilities first published in this month (UTC), newest first.
17 results · Clear filters · Feed
-
Low 2.4
RSA BSAFE Micro Edition Suite versions prior to 4.4 (in 4.0.x, 4.1.x, 4.2.x and 4.3.x) are vulnerable to a Heap-based B…
-
Low 2.7
SilverStripe Priviledge escalation through cache pollution
In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution.
-
Low 3.3
Jenkins elOyente Plugin has Insufficiently Protected Credentials
Jenkins elOyente Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Assembla Plugin has Insufficiently Protected Credentials
Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins CodeScan Plugin has Insufficiently Protected Credentials
Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins vFabric Application Director Plugin Insufficiently Protected Credentials
Jenkins vFabric Application Director Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.1
Jenkins Inedo ProGet Plugin Plugin has Cleartext Transmission of Sensitive Information
Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
-
Low 3.1
Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form
Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
-
Low 3.3
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabiliti…
-
Low 3.7
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sens…
-
Low 3.7
IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or s…
-
Low 3.5
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pol…
-
Low —
Use of a weak cryptographic algorithm in Gradle
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.
-
Low 3.1
Jenkins Aqua Security Serverless Scanner Plugin showed plain text password in job configuration form fields
Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure.
-
Low 3.3
Jenkins Beaker Builder Plugin has Insufficiently Protected Credentials
Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
-
Low —
Undefined Behavior in sailsjs-cacheman
All versions of `sailsjs-cacheman` have a vulnerability that may lead to Undefined Behavior. The config variable is exposing to the global scope which may overwrite other variables and cause the application to misbehave. ## Recommendation No fix is currently …
-
Low —
Sensitive Data Exposure in seneca
Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users.