CVSS: 6.5EPSS: 1%CPEs: 3EXPL: 0CVE-2015-1806 – jenkins: Combination filter Groovy script unsecured (SECURITY-125)
https://notcve.org/view.php?id=CVE-2015-1806
01 Oct 2015 — The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors. La secuencia de comandos del filtro de combinación Groovy en Jenkins en versiones anteriores a 1.600 y LTS en versiones anteriores a 1.596.1 permite a usuarios remotos autenticados con permisos de configuración de trabajo obtener privilegios y ejecutar código arbitrario en e... • http://rhn.redhat.com/errata/RHSA-2015-1844.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2015-1807 – jenkins: directory traversal from artifacts via symlink (SECURITY-162)
https://notcve.org/view.php?id=CVE-2015-1807
01 Oct 2015 — Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts. Vulnerabilidad de salto de directorio en Jenkins en versiones anteriores a 1.600 y LTS en versiones anteriores a 1.596.1 permite a usuarios remotos autenticados con ciertos permisos para leer archivos arbitrarios a través de un enlace simbólico, relacionado con los objetos de construcción. It was foun... • http://rhn.redhat.com/errata/RHSA-2015-1844.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 3.5EPSS: 0%CPEs: 3EXPL: 0CVE-2015-1808 – jenkins: update center metadata retrieval DoS attack (SECURITY-163)
https://notcve.org/view.php?id=CVE-2015-1808
01 Oct 2015 — Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data. Jenkins en versiones anteriores a 1.600 y LTS en versiones anteriores a 1.596.1 permite a usuarios remotos autenticados provocar una denegación de servicio (plug-in indebido e instalación de herramienta) a través del centro de datos actualizado manipulado. A denial of service flaw was found in the way Jenkins handled certain updat... • http://rhn.redhat.com/errata/RHSA-2015-1844.html • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2015-1810 – jenkins: HudsonPrivateSecurityRealm allows creation of reserved names (SECURITY-166)
https://notcve.org/view.php?id=CVE-2015-1810
01 Oct 2015 — The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name. La clase HudsonPrivateSecurityRealm en Jenkins en versiones anteriores a 1.600 y LTS en versiones anteriores a 1.596.1 no restringe el acceso a nombres reservados cuando usan la configuración "base de datos de usuario propia Jenkins", lo que permite a at... • http://rhn.redhat.com/errata/RHSA-2015-1844.html • CWE-20: Improper Input Validation CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2015-1812 – jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://notcve.org/view.php?id=CVE-2015-1812
01 Oct 2015 — Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813. Vulnerabilidad de XSS en Jenkins en versiones anteriores a 1.606 y LTS en versiones anteriores a 1.596.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados, una vulnerabilidad diferente a CVE-2015-1813. Two cross-site sc... • http://rhn.redhat.com/errata/RHSA-2015-1844.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2015-1813 – jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://notcve.org/view.php?id=CVE-2015-1813
01 Oct 2015 — Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1812. Vulnerabilidad de XSS en Jenkins en versiones anteriores a 1.606 y LTS en versiones anteriores a 1.596.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados, una vulnerabilidad diferente a CVE-2015-1812. Two cross-site sc... • http://rhn.redhat.com/errata/RHSA-2015-1844.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2015-1814 – jenkins: forced API token change (SECURITY-180)
https://notcve.org/view.php?id=CVE-2015-1814
01 Oct 2015 — The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users. El servicio de emisión de token de API en Jenkins en versiones anteriores a 1.606 y LTS en versiones anteriores a 1.596.2 permite a atacantes remotos obtener privilegios a través de un "cambio forzado de token de API" involucrando a usuarios anónimos. A flaw was found in the Jenkins API token-issuing service. The service was not pr... • http://rhn.redhat.com/errata/RHSA-2015-1844.html • CWE-264: Permissions, Privileges, and Access Controls CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 1CVE-2012-6685 – rubygem-nokogiri: XML eXternal Entity (XXE) flaw
https://notcve.org/view.php?id=CVE-2012-6685
13 Aug 2015 — Nokogiri before 1.5.4 is vulnerable to XXE attacks Nokogiri versiones anteriores a 1.5.4, es vulnerable a ataques de tipo XXE. OS X Yosemite 10.10.5 and Security Update 2015-006 is now available and addresses vulnerabilities in Apache, the OD plug-in, IOBluetoothHCIController, and more. • https://bugzilla.redhat.com/show_bug.cgi?id=1178970 • CWE-611: Improper Restriction of XML External Entity Reference CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') •
CVSS: 7.5EPSS: 0%CPEs: 16EXPL: 0CVE-2014-3602 – OpenShift: /proc/net/tcp information disclosure
https://notcve.org/view.php?id=CVE-2014-3602
03 Nov 2014 — Red Hat OpenShift Enterprise before 2.2 allows local users to obtain IP address and port number information for remote systems by reading /proc/net/tcp. Red Hat OpenShift Enterprise anterior a 2.2 permite a usuarios locales obtener direcciones IP y otra información para sistemas remotos mediante la lectura de /proc/net/tcp. It was found that OpenShift Enterprise did not restrict access to the /proc/net/tcp file in gears, which allowed local users to view all listening connections and connected sockets. This... • http://rhn.redhat.com/errata/RHSA-2014-1796.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.1EPSS: 0%CPEs: 16EXPL: 0CVE-2014-3674 – Enterprise: gears fail to properly isolate network traffic
https://notcve.org/view.php?id=CVE-2014-3674
03 Nov 2014 — Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows remote attackers to access the network resources of arbitrary gears via unspecified vectors. Red Hat OpenShift Enterprise anterior a 2.2 no restringe debidamente el acceso a gears, lo que permite a atacantes remotos acceder a los recursos de red de gears arbitrarios a través de vectores no especificados. It was found that OpenShift Enterprise 2.1 did not properly restrict access to services running on different ... • http://rhn.redhat.com/errata/RHSA-2014-1796.html • CWE-264: Permissions, Privileges, and Access Controls CWE-284: Improper Access Control •