23 October 2019

14 results · Clear filters · Feed

• Medium 5.5
  CVE-2019-12415

  Improper Restriction of XML External Entity Reference in Apache POI

  In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External E…

  libapache-poi-java libapache-poi-java org.apache.poi:poi Debian Ubuntu Maven
  Oct 23, 2019
• Medium 5.4
  CVE-2019-18348

  An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine
  Oct 23, 2019
• Medium 6.1
  CVE-2019-17606

  hexo-admin plugin for Node.js XSS Vulnerability

  The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post.

  hexo-admin npm
  Oct 23, 2019
• Medium 4.3
  CVE-2019-11282

  UAA is vulnerable to a Blind SCIM injection leading to information disclosure

  Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of t…

  Cloud Foundry CF Deployment UAA Release
  Oct 23, 2019
• Medium 4.3
  CVE-2019-10474

  Jenkins Global Post Script Plugin missing permission check

  A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to the plugin stored on the Jenkins master file system.

  Jenkins Project Jenkins Global Post Script Plugin org.jenkins-ci.plugins:global-post-script Web / CMS Maven
  Oct 23, 2019
• Medium 6.1
  CVE-2019-10475 Public exploit Scanner template EPSS 58%

  Jenkins build-metrics Plugin reflected cross-site scripting vulnerability

  A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.

  Jenkins Project Jenkins build-metrics Plugin org.jenkins-ci.plugins:build-metrics Web / CMS Maven
  Oct 23, 2019
• Medium 4.3
  CVE-2019-10473

  Jenkins Libvirt Slaves Plugin vlnerable to Credential Enumeration

  A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

  Jenkins Project Jenkins Libvirt Slaves Plugin org.jenkins-ci.plugins:libvirt-slave Web / CMS Maven
  Oct 23, 2019
• Medium 6.5
  CVE-2019-10472

  Jenkins Libvirt Slaves Plugin vlnerable to Incorrect Default Permissions

  A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in …

  Jenkins Project Jenkins Libvirt Slaves Plugin org.jenkins-ci.plugins:libvirt-slave Web / CMS Maven
  Oct 23, 2019
• Medium 6.5
  CVE-2019-10470

  Jenkins Kubernetes CI/CD Plugin vulnerable to Credential Enumeration

  A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

  Jenkins Project Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin com.elasticbox.jenkins-ci.plugins:kubernetes-ci Web / CMS Maven
  Oct 23, 2019
• Medium 6.5
  CVE-2019-10469

  Jenkins Kubernetes CI/CD Plugin vulnerable to Improper Authorization

  A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credenti…

  Jenkins Project Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin com.elasticbox.jenkins-ci.plugins:kubernetes-ci Web / CMS Maven
  Oct 23, 2019
• Medium 6.5
  CVE-2019-10467

  Jenkins Sonar Gerrit Plugin stores credentials unencrypted

  Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

  Jenkins Project Jenkins Sonar Gerrit Plugin org.jenkins-ci.plugins:sonar-gerrit Web / CMS Maven
  Oct 23, 2019
• Medium 4.3
  CVE-2019-10465

  Jenkins Deploy WebLogic Plugin missing permission check

  A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials, or determine whether a file or directory with an attacker-specified path e…

  Jenkins Project Jenkins Deploy WebLogic Plugin org.jenkins-ci.plugins:weblogic-deployer-plugin Web / CMS Maven
  Oct 23, 2019
• Medium 6.5
  CVE-2019-10463

  Jenkins Dynatrace Plugin contains Incorrect Default Permissions

  A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

  Jenkins Project Jenkins Dynatrace Application Monitoring Plugin org.jenkins-ci.plugins:dynatrace-dashboard Web / CMS Maven
  Oct 23, 2019
• Medium 6.5
  CVE-2019-10459

  Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token

  Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permissio…

  Jenkins Project Jenkins Mattermost Notification Plugin org.jenkins-ci.plugins:mattermost Web / CMS Maven
  Oct 23, 2019