Archive
February 2020
Vulnerabilities first published in this month (UTC), newest first.
1,406 results · Feed
-
Medium 4.3
Password stored in plain text by Dynamic Extended Choice Parameter Plugin
Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 5.4
Stored XSS vulnerability in Jenkins brakeman Plugin
Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cross-site scripting vulnerability exploitable by users able to control the Brakeman post-build step input data.
-
High 8.8
RCE vulnerability in Google Kubernetes Engine Plugin
Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
-
High 7.6
XXE vulnerability in FitNesse Plugin
Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.
-
Medium 4.3
Users with Overall/Read access can enumerate credential IDs in Pipeline GitHub Notify Step Plugin
A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
-
Low 3.1
Client secret transmitted in plain text by Azure AD Plugin
Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
-
High 7.1
Missing permission checks in Pipeline GitHub Notify Step Plugin allows capturing credentials
A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturin…
-
High 7.1
CSRF vulnerability in Pipeline GitHub Notify Step Plugin allows capturing credentials
A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials…
-
High 7.6
XXE vulnerability in NUnit Plugin
Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.
-
Low 3.1
Jenkins S3 Publisher Plugin transmits credentials in plain text during configuration
Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
-
Medium 5.4
Jenkins Git Parameter Plugin vulnerable to stored cross-site scripting (XSS)
Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.
-
Medium 5.4
Jenkins Git Parameter Plugin vulnerable to Stored cross-site scripting (XSS)
Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.
-
Medium 5.4
Subversion Plugin stored XSS vulnerability
Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability.
-
High 8.8
Improper Input Validation in Jenkins Pipeline: Groovy Plugin
Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.
-
High 8.8
Improper Input Validation in Jenkins Script Security Plugin
Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
-
Unscored —
SQL injection vulnerability in pub/m_pending_news/delete_pending_news.jsp in Enorth Webpublisher CMS allows remote atta…
-
Critical 9.8
Potential Command Injection in libnotify
libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.
-
Unscored —CVE-2019-19194 Public exploit
The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before N…
-
Unscored —
The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before N…
-
Unscored —
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. T…
-
Unscored —
The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are a…
-
Unscored —
The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vuln…
-
Unscored —
The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulne…
-
Critical 9.8
Potential Command Injection in hubot-scripts
scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.
-
Unscored —
Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allo…
-
Unscored —
The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authenticat…
-
Unscored —
The SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a response to an invalid aut…
-
Unscored —CVE-2014-2560 Public exploit
The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, whic…
-
Unscored —
The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a de…
-
Unscored —
Heap-based buffer overflow in the bmp_decode_rle function in libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent atta…
-
Unscored —
LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attac…
-
Critical 9.8
JGit Improper Input Validation vulnerability
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up…
-
Unscored —
Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other p…
-
Unscored —
Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a per…
-
Unscored —CVE-2014-4968 Public exploit
The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 fo…
-
Unscored —
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a …
-
Medium 5.9
opencontainers runc contains procfs race condition with a shared volume mount
runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run cus…
-
Unscored —
An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and…
-
Unscored —
An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force se…
-
Unscored —
An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-fo…