Archive
17 December 2019
Vulnerabilities first published on this day (UTC), newest first.
71 results · Feed
-
Medium 5.4
Cross site scripting in Jenkins Mission Control Plugin
Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to change these properties.
-
Medium 5.4
Jenkins buildgraph-view Plugin vulnerable to stored Cross-site Scripting
Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS vulnerability exploitable by users able to change build descriptions.
-
High 8.8
Cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin
A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.
-
High 7.1
SSL/TLS certificate validation globally and unconditionally disabled by Jenkins WebSphere Deployer Plugin
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM.
-
Medium 5.4
Jenkins WebSphere Deployer Plugin missing permission check
A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.
-
High 8.2
Improper Certificate Validation in Jenkins Spira Importer Plugin
Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM.
-
Medium 6.5
Jenkins Redgate SQL Change Automation Plugin has Insufficiently Protected Credentials
Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 6.5
Jenkins Rundeck Plugin stored credentials in plain text
Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Missing permission check in Jenkins Build Failure Analyzer Plugin
A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.
-
Medium 6.5
Inefficient Regular Expression Complexity in Jenkins Build Failure Analyzer Plugin
A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process.
-
Medium 5.4
Missing permission check in Jenkins Gerrit Trigger Plugin
A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file …
-
High 8.8
Cross-Site Request Forgery in Jenkins Build Failure Analyzer Plugin
A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression.
-
High 8.8
Cross-site request forgery (CSRF) vulnerability in Jenkins Maven Release Plugin
A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents.
-
High 7.1
Jenkins Maven Release Plug-in Plugin XXE vulnerability
Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents.
-
High 8.8
Cross-Site Request Forgery in Jenkins Gerrit Trigger Plugin
A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials.
-
High 8.8
Unrestricted file uploads in Contao
Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server.
-
Medium 5.3
Insert tag injection in the Contao login module
Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered.
-
Medium 5.3
Information disclosure in the Contao backend
Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.
-
Unscored —
In Simplifile RecordFusion through 2019-11-25, the logs and hist parameters allow remote attackers to access local file…
-
Unscored —
Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2).. The encryption key…
-
Unscored —
Barco ClickShare Button R9861500D01 devices before 1.9.0 have incorrect Credentials Management. The ClickShare Button i…
-
Unscored —
Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The Barco signed…
-
Unscored —
Barco ClickShare Huddle CS-100 devices before 1.9.0 and CSE-200 devices before 1.9.0 have incorrect Credentials Managem…
-
Unscored —
Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The ClickShare B…
-
Unscored —
In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause a NULL pointer dereference in f2fs_recov…
-
Unscored —
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out…
-
Unscored —
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a sy…
-
Unscored —
In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bound…
-
Unscored —
_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the databas…
-
Unscored —
The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.1…
-
Unscored —
Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modif…