Archive

29 January 2020

Vulnerabilities first published on this day (UTC), newest first.

← December 2019 2020 / January /29 February 2020 →

All Critical High Medium Low Exploited only Public exploit

54 results · Feed

Low 3.1

CVE-2020-2105

Jenkins REST APIs vulnerable to clickjacking

REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

Jan 29, 2020
Medium 5.4

CVE-2020-2103 Scanner template

Jenkins Diagnostic page exposed session cookies

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

Jan 29, 2020
Medium 4.3

CVE-2020-2104

Memory usage graphs accessible to anyone with Overall/Read

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

Jan 29, 2020
Medium 5.8

CVE-2020-2100

Jenkins vulnerable to UDP amplification reflection attack

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848.

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

Jan 29, 2020
Medium 5.3

CVE-2020-2102

Non-constant time HMAC comparison

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

Jan 29, 2020
Medium 5.3

CVE-2020-2101

Non-constant time comparison of inbound TCP agent connection secret

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

Jan 29, 2020
High 8.6

CVE-2020-2099

Inbound TCP Agent Protocol/3 authentication bypass in Jenkins

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be u…

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

Jan 29, 2020
Unscored —

CVE-2013-0161 Public exploit

Havalite CMS 1.1.7 has a stored XSS vulnerability

Havalite CMS

Jan 29, 2020
Unscored —

CVE-2012-5776

Dokeos 2.1.1 has multiple XSS issues involving "extra_" parameters in main/auth/profile.php.

Jan 29, 2020
High 8.8

CVE-2012-4383

Contao core SQL Injection Vulnerability

contao prior to 2.11.4 has a sql injection vulnerability

contao contao contao/core Packagist

Jan 29, 2020
High 8.8

CVE-2020-7965

Cross-Site Request Forgery in Webargs

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allo…

webargs PyPI

Jan 29, 2020
Unscored —

CVE-2019-20217

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to …

Jan 29, 2020
Unscored —

CVE-2019-20216

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to …

Jan 29, 2020
Unscored —

CVE-2019-20215 Public exploit EPSS 75%

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to th…

Jan 29, 2020