Archive
21 November 2019
Vulnerabilities first published on this day (UTC), newest first.
106 results · Feed
-
Unscored —
-
Medium 4.3
Jenkins Google Compute Engine Plugin Cross-Site Request Forgery vulnerability
A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents.
-
Medium 4.3
Jenkins Google Compute Engine Plugin Missing Authorization vulnerability
Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment.
-
Medium 6.8
Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin
Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.
-
Low 3.1
Jenkins QMetry for JIRA Plugin shows plain text password in configuration form
Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.
-
Medium 4.3
Jenkins QMetry for JIRA Plugin stored credentials in plain text
Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Low —
Plaintext Storage in Jenkins Spira Importer Plugin
Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Medium 6.5
Jenkins JIRA Plugin allows users to select and use credentials with System scope
Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.
-
Medium 6.5
Jenkins Anchore Container Scanner Plugin vulnerable to Insufficiently Protected Credentials
Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
High 7.1
Jenkins Support Core Plugin allowed users with Overall/Read permission to delete arbitrary files
A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete arbitrary files on the Jenkins master.
-
Medium 6.5
Missing permission check in Jenkins Support Core Plugin
A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles.
-
High 8.8
Incorrect Authorization in Jenkins Script Security Plugin
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.
-
Unscored —
Nitro Pro before 13.2 creates a debug.log file in the directory where a .pdf file is located, if the .pdf document was …
-
Medium 5.5
openshift-origin-node Improper Input Validation vulnerability
Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.
-
Unscored —
-
Unscored —
-
Medium 5.5
net-ldap has weak salt when generating passwords
The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords.
-
Unscored —
pam_shield before 0.9.4: Default configuration does not perform protective action
-
Unscored —
Slackware 13.1, 13.37, 14.0 and 14.1 contain world-writable permissions on the iodbctest and iodbctestw programs within…
-
High 7.5
trytond Incorrect Authorization vulnerability
trytond 2.4: ModelView.button fails to validate authorization
-
Unscored —
Slackware 14.0 and 14.1, and Slackware LLVM 3.0-i486-2 and 3.3-i486-2, contain world-writable permissions on the /tmp d…
-
Unscored —
crust repo has been archived; use libp2p instead
** The `crust` crate repo was archived with no warning or explanation.** Given that it was archived with no warning or successor, there's not an official replacement but [`rust-libp2p`](https://github.com/libp2p/rust-libp2p) looks like it's got a similar feat…
-
Unscored —
ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_rea…
-
Unscored —
btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_de…
-
Unscored —
__btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain EN…
-
Unscored —
In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorr…