Archive
9 March 2020
Vulnerabilities first published on this day (UTC), newest first.
13 results · Clear filters · Feed
-
High 7.8
Dell Digital Delivery versions prior to 3.5.2015 contain an incorrect default permissions vulnerability. A locally auth…
-
High 7.9
Remote Code Execution Through Image Uploads in BookStack
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impa…
-
High 7.5
Path Traversal in Ansible
A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantag…
-
High 8.8
Froxlor arbitrary code execution via the database configuration options
An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in ins…
-
High 8.8
OS command injection in CryptoMove Plugin
Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins.
-
High 8.8
Remote Code Execution vulnerability in Jenkins Literate Plugin
Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
-
High 7.1
XXE vulnerability in Rundeck Plugin
Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
High 7.1
XXE vulnerability in Jenkins Cobertura Plugin
Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
High 8.8
Sandbox bypass vulnerability in Script Security Plugin
Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterceptable.
-
High 8.8
Sandbox bypass vulnerability in Script Security Plugin
Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted constructor bodies.
-
High 7.5
The IBM Spectrum Scale 4.2 and 5.0 file system component is affected by a denial of service security vulnerability. An …
-
High 7.2
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in t…
KEV Mar 25, 2022 -
High 7.0
It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3,…