Category

Web / CMS

26,877 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1,610 results · Clear filters · Feed

Critical 9.9

CVE-2019-1003032

Script security sandbox bypass in Jenkins Email Extension Plugin

A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hu…

Jenkins Project Jenkins Email Extension Plugin org.jenkins-ci.plugins:email-ext Web / CMS Maven

Mar 8, 2019
Critical 9.9

CVE-2019-1003034

Script security sandbox bypass in Jenkins Job DSL Plugin

A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhi…

Jenkins Project Jenkins Job DSL Plugin org.jenkins-ci.plugins:job-dsl Web / CMS Maven

Mar 8, 2019
Critical 9.9

CVE-2019-1003029 Exploited Public exploit EPSS 74%

Sandbox bypass in Script Security Plugin

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScr…

Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven

Mar 8, 2019
KEV Apr 25, 2022
Critical 9.9

CVE-2019-1003031

Script security sandbox bypass in Matrix Project Plugin

A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

Jenkins Project Jenkins Matrix Project Plugin org.jenkins-ci.plugins:matrix-project Web / CMS Maven

Mar 8, 2019
Critical 9.9

CVE-2019-1003030 Exploited Public exploit Scanner template EPSS 97%

Sandbox bypass in Jenkins Pipeline: Groovy Plugin

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the …

Jenkins Project Jenkins Pipeline: Groovy Plugin org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven

Mar 8, 2019
KEV Mar 25, 2022
Critical 9.1

CVE-2019-1003015

XXE vulnerability in Jenkins Job Import Plugin

An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server (Jenkins) queried…

Jenkins Project Jenkins Job Import Plugin org.jenkins-ci.plugins:job-import-plugin Web / CMS Maven

Feb 6, 2019
Critical 9.8

CVE-2019-6339 Public exploit EPSS 36%

PHAR stream wrapper Arbitrary PHP code execution

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, c…

Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist

Jan 22, 2019
Critical 9.8

CVE-2017-6920 EPSS 20%

Drupal PECL YAML parser unsafe object handling

Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.

Drupal Drupal core drupal/core drupal/drupal Web / CMS Packagist

Aug 6, 2018
Critical 9.8

CVE-2018-7600 Exploited · Ransomware Public exploit Scanner template EPSS 100%

Drupal Core Remote Code Execution Vulnerability

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

drupal/core drupal/drupal drupal7 drupal7 Web / CMS Ubuntu Alpine Packagist

Mar 29, 2018
KEV Nov 3, 2021
Critical 9.8

CVE-2017-2641 Public exploit EPSS 15%

Moodle SQL injection via user preferences

In Moodle 2.x and 3.x, SQL injection can occur via user preferences.

moodle/moodle Web / CMS Packagist

Mar 26, 2017