Archive
9 March 2020
Vulnerabilities first published on this day (UTC), newest first.
68 results · Feed
-
Medium 6.1
Jenkins Subversion Release Manager Plugin vulnerable to cross-site scripting (XSS)
Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
-
Low 3.1
Jenkins Quality Gates Plugin transmits credentials in plain text during configuration
Jenkins Quality Gates Plugin 2.5 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
-
Medium 4.3
Missing permission checks in Mac Plugin
A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials.
-
Low 3.1
Jenkins Sonar Quality Gates Plugin transmits credentials in plain text during configuration
Jenkins Sonar Quality Gates Plugin 1.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
-
Low 3.1
Credentials transmitted in plain text by Repository Connector Plugin
Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
-
Medium 4.3
CSRF vulnerability in Mac Plugin
A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.
-
Medium 6.8
Missing SSH host key validation in Mac Plugin
Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.
-
High 7.1
XXE vulnerability in Rundeck Plugin
Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Low 3.3
Credentials stored in plain text by Zephyr Enterprise Test Management Plugin
Jenkins Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text on the Jenkins master file system.
-
Medium 4.3
Missing permission checks in Jenkins P4 Plugin
A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds.
-
Low 3.1
Credentials transmitted in plain text by Jenkins Logstash Plugin
Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
-
Medium 4.3
CSRF vulnerability in Jenkins P4 Plugin
A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Perforce.
-
Medium 6.1
XSS vulnerability in Jenkins Audit Trail Plugin
Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
-
Medium 6.5
Arbitrary file write vulnerability in Jenkins Cobertura Plugin
An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any file on the Jenkins master file system.
-
High 7.1
XXE vulnerability in Jenkins Cobertura Plugin
Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Medium 5.4
Improper Neutralization of Input During Web Page Generation in Jenkins Git Plugin
Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability.
-
Medium 4.8
Stored XSS vulnerability in Jenkins Timestamper Plugin
Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.
-
High 8.8
Sandbox bypass vulnerability in Script Security Plugin
Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterceptable.
-
High 8.8
Sandbox bypass vulnerability in Script Security Plugin
Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted constructor bodies.
-
High 7.5
The IBM Spectrum Scale 4.2 and 5.0 file system component is affected by a denial of service security vulnerability. An …
-
Unscored —
In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed …
-
Unscored —
In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, certain personal information is discove…
-
Unscored —
JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.
-
Unscored —
HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].
-
Medium 6.4
nwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusi…
-
Unscored —CVE-2019-20504 Scanner template
service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attac…
-
High 7.2
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in t…
KEV Mar 25, 2022 -
High 7.0
It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3,…