CVSS: 10.0EPSS: 96%CPEs: 3EXPL: 3CVE-2018-1000861 – Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
https://notcve.org/view.php?id=CVE-2018-1000861
10 Dec 2018 — A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way. Existe una vulnerabilidad de ejecución de código en el framework web de Stapler empleando por Jenkins en versiones 2.153 y anteriores, y LTS 2.138.3 y anteriores en stapler/core/src/main/... • https://packetstorm.news/files/id/166778 • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1999045
https://notcve.org/view.php?id=CVE-2018-1999045
23 Aug 2018 — A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled. Existe una vulnerabilidad de autenticación incorrecta en Jenkins en versiones 2.137 y anteriores y 2.121.2 y anteriores en SecurityRealm.java y TokenBasedRememberMeServices2.java que permite que los atacantes con una cookie válida mantengan su sesión abierta in... • https://jenkins.io/security/advisory/2018-08-15/#SECURITY-996 • CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1999042
https://notcve.org/view.php?id=CVE-2018-1999042
23 Aug 2018 — A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL. Existe una vulnerabilidad en Jenkins en versiones 2.137 y anteriores y 2.121.2 y anteriores en XStream2.java que permite que los atacantes hagan que Jenkins resuelva un nombre de dominio cuando se deserializa una instancia de java.net.URL. • https://jenkins.io/security/advisory/2018-08-15/#SECURITY-637 • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1999047
https://notcve.org/view.php?id=CVE-2018-1999047
23 Aug 2018 — A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers to cancel a Jenkins restart scheduled through the update center. Existe una vulnerabilidad de autorización incorrecta en Jenkins en versiones 2.137 y anteriores y 2.121.2 y anteriores en UpdateCenter.java que permite que los atacantes cancelen un reinicio de Jenkins programado a través del centro de actualizaciones. • https://jenkins.io/security/advisory/2018-08-15/#SECURITY-1076 • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1999043
https://notcve.org/view.php?id=CVE-2018-1999043
23 Aug 2018 — A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.java that allows attackers to create ephemeral in-memory user records by attempting to log in using invalid credentials. Existe una vulnerabilidad de denegación de servicio (DoS) en Jenkins en versiones 2.137 y anteriores y 2.121.2 y anteriores en BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.java que permite que los atacantes creen... • https://jenkins.io/security/advisory/2018-08-15/#SECURITY-672 • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1999046
https://notcve.org/view.php?id=CVE-2018-1999046
23 Aug 2018 — A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attackers With Overall/Read permission to access the connection log for any agent. Existe una vulnerabilidad de exposición de información sensible en Jenkins en versiones 2.137 y anteriores y 2.121.2 y anteriores en Computer.java que permite que los atacantes con permiso Overall/Read accedan al registro de conexiones para cualquier agente. • https://jenkins.io/security/advisory/2018-08-15/#SECURITY-1071 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1999044
https://notcve.org/view.php?id=CVE-2018-1999044
23 Aug 2018 — A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop. Existe una vulnerabilidad de denegación de servicio (DoS) en Jenkins en versiones 2.137 y anteriores y 2.121.2 y anteriores en CronTab.java que permite que los atacantes con permiso Overall/Read hagan que un hilo de gestión de peticiones se meta en un bucle infinito. • https://jenkins.io/security/advisory/2018-08-15/#SECURITY-790 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1999006
https://notcve.org/view.php?id=CVE-2018-1999006
23 Jul 2018 — A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackers to determine the date and time when a plugin HPI/JPI file was last extracted, which typically is the date of the most recent installation/upgrade. Existe una vulnerabilidad de exposición de información sensible en Jenkins 2.132 y anteriores y 2.121.1 y anteriores en Plugin.java que permite que los atacantes determinen la fecha y hora cuando un archivo de plugin HPI/... • https://jenkins.io/security/advisory/2018-07-18/#SECURITY-925 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1999007
https://notcve.org/view.php?id=CVE-2018-1999007
23 Jul 2018 — A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins to define JavaScript that would be executed in another user's browser when that other user views HTTP 404 error pages while Stapler debug mode is enabled. Existe una vulnerabilidad de Cross-Site Scripting (XSS) en Jenkins 2.132 y anteriores y 2.121.1 y anteriores en... • https://jenkins.io/security/advisory/2018-07-18/#SECURITY-390 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1999004
https://notcve.org/view.php?id=CVE-2018-1999004
23 Jul 2018 — A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches. Existe una vulnerabilidad de autorización incorrecta en Jenkins 2.132 y anteriores y 2.121.1 y anteriores en SlaveComputer.java que permite que los atacantes con el permiso Overall/Read inicien el arranque de los agentes y aborten el arranque en proceso de los agentes. • https://jenkins.io/security/advisory/2018-07-18/#SECURITY-892 • CWE-863: Incorrect Authorization •