Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
1,661 results · Feed
-
Medium 5.9
Vulnerability in the Database Gateway for ODBC component of Oracle Database Server. Supported versions that are affecte…
-
Low 2.4
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2,…
-
Low 3.3
Vulnerability in the Database Gateway for ODBC component of Oracle Database Server. Supported versions that are affecte…
-
Medium 4.1
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2,…
-
Medium 5.0
Vulnerability in the Database Gateway for ODBC component of Oracle Database Server. Supported versions that are affecte…
-
Medium 6.1
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). The supported…
-
High 7.7
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2,…
-
Medium 4.3
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…
-
Medium 6.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …
-
High 7.5
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12…
-
High 7.5
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4,…
-
Medium 5.4
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …
-
High 7.1
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). The supported…
-
Medium 6.1
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authenticati…
-
Low 3.1
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: BI…
-
Unscored —
The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote att…
-
Unscored —
Systrace before 1.6.0 has insufficient escape policy enforcement.
-
Unscored —
Directory traversal vulnerability in Thomson Reuters for FATCA before 5.2 allows remote attackers to execute arbitrary …
-
Unscored —
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability.…
-
Unscored —
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an user interface injection vulnerability. Succ…
-
Unscored —
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an expression language injection vulnerability.…
-
Unscored —
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability.…
-
Unscored —CVE-2005-4891 Public exploit
Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers …
-
Unscored —CVE-2015-5466 Public exploit
Silicon Integrated Systems XGI WindowsXP Display Manager (aka XGI VGA Driver Manager and VGA Display Manager) 6.14.10.1…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated us…
-
High 8.8
Missing permission checks in Jenkins Sounds Plugin allow OS command execution
Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins.
-
High 8.8
CSRF vulnerability in Jenkins Sounds Plugin allow OS command execution
A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account running Jenkins.
-
Medium 6.1
Reflected XSS vulnerability in Jenkins gitlab-hook Plugin
Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.
-
Medium 4.3
Redgate SQL Change Automation Plugin stored credentials in plain text
Jenkins Redgate SQL Change Automation Plugin 2.0.4 and earlier stored an API key unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 5.0
Missing permission checks in Health Advisor by CloudBees Plugin
A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to send a fixed email to an attacker-specific recipient.
-
High 7.6
XXE vulnerability in Jenkins Robot Framework Plugin
Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents.
-
Medium 5.0
CSRF vulnerability in Health Advisor by CloudBees Plugin
A cross-site request forgery vulnerability in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers to send an email with fixed content to an attacker-specified recipient.
-
Low 3.1
CSRF vulnerability in Jenkins Amazon EC2 Plugin
A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method.
-
Unscored —
JetBrains IDETalk plugin before version 193.4099.10 allows XXE
-
Unscored —
Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary…
-
Unscored —CVE-2015-7556 Public exploit
DeleGate 9.9.13 allows local users to gain privileges as demonstrated by the dgcpnod setuid program.
-
High 7.1
PyAMF vulnerable to XML external entity (XXE)
XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.
-
Unscored —
-
Unscored —
Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php.
-
Unscored —