Page 7 of 89 results (0.016 seconds)

CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0

CVE-2015-5324 – jenkins: Queue API did show items not visible to the current user (SECURITY-186)

https://notcve.org/view.php?id=CVE-2015-5324

25 Nov 2015 — Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api. Jenkins en versiones anteriores a 1.638 y LTS en versiones anteriores a 1.625.2 permiten a atacantes remotos obtener información sensible a través de petición directa a queue/api. OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service solution designed for on-premise or private cloud deployments. The following security issues are addressed with... • http://rhn.redhat.com/errata/RHSA-2016-0489.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0

CVE-2015-5325 – jenkins: JNLP slaves not subject to slave-to-master access control (SECURITY-206)

https://notcve.org/view.php?id=CVE-2015-5325

25 Nov 2015 — Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665. Jenkins en versiones anteriores a 1.638 y LTS en versiones anteriores a 1.625.2 permite a atacantes eludir las restricciones slave-to-master destinadas al acceso aprovechando un esclavo JNLP. NOTA: esta vulnerabilidad existe a causa de una solución incompleta para CVE-2014-3665. OpenShift... • http://rhn.redhat.com/errata/RHSA-2016-0489.html • CWE-284: Improper Access Control •

CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0

CVE-2015-5326 – jenkins: Stored XSS vulnerability in slave offline status message (SECURITY-214)

https://notcve.org/view.php?id=CVE-2015-5326

25 Nov 2015 — Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message. Vulnerabilidad de XSS en la página de vista general de esclavos en Jenkins en versiones anteriores a 1.638 y LTS en versiones anteriores a 1.625.2 permite a usuarios remotos autenticados con ciertos permisos inyectar secuencias de comandos web o HTML arbitrario... • http://rhn.redhat.com/errata/RHSA-2016-0489.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 4%CPEs: 4EXPL: 0

CVE-2015-5317 – Jenkins User Interface (UI) Information Disclosure Vulnerability

https://notcve.org/view.php?id=CVE-2015-5317

25 Nov 2015 — The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request. Las páginas Fingerprints en Jenkins en versiones anteriores a 1.638 y LTS en versiones anteriores a 1.625.2 podrían permitir a atacantes remotos obtener trabajo sensible y construir la información de nombre a través de una petición directa. OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service solution des... • http://rhn.redhat.com/errata/RHSA-2016-0489.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2015-1814 – jenkins: forced API token change (SECURITY-180)

https://notcve.org/view.php?id=CVE-2015-1814

01 Oct 2015 — The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users. El servicio de emisión de token de API en Jenkins en versiones anteriores a 1.606 y LTS en versiones anteriores a 1.596.2 permite a atacantes remotos obtener privilegios a través de un "cambio forzado de token de API" involucrando a usuarios anónimos. A flaw was found in the Jenkins API token-issuing service. The service was not pr... • http://rhn.redhat.com/errata/RHSA-2015-1844.html • CWE-264: Permissions, Privileges, and Access Controls CWE-284: Improper Access Control •

CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2015-1806 – jenkins: Combination filter Groovy script unsecured (SECURITY-125)

https://notcve.org/view.php?id=CVE-2015-1806

01 Oct 2015 — The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors. La secuencia de comandos del filtro de combinación Groovy en Jenkins en versiones anteriores a 1.600 y LTS en versiones anteriores a 1.596.1 permite a usuarios remotos autenticados con permisos de configuración de trabajo obtener privilegios y ejecutar código arbitrario en e... • http://rhn.redhat.com/errata/RHSA-2015-1844.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0

CVE-2015-1807 – jenkins: directory traversal from artifacts via symlink (SECURITY-162)

https://notcve.org/view.php?id=CVE-2015-1807

01 Oct 2015 — Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts. Vulnerabilidad de salto de directorio en Jenkins en versiones anteriores a 1.600 y LTS en versiones anteriores a 1.596.1 permite a usuarios remotos autenticados con ciertos permisos para leer archivos arbitrarios a través de un enlace simbólico, relacionado con los objetos de construcción. It was foun... • http://rhn.redhat.com/errata/RHSA-2015-1844.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-59: Improper Link Resolution Before File Access ('Link Following') •

CVSS: 3.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2015-1808 – jenkins: update center metadata retrieval DoS attack (SECURITY-163)

https://notcve.org/view.php?id=CVE-2015-1808

01 Oct 2015 — Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data. Jenkins en versiones anteriores a 1.600 y LTS en versiones anteriores a 1.596.1 permite a usuarios remotos autenticados provocar una denegación de servicio (plug-in indebido e instalación de herramienta) a través del centro de datos actualizado manipulado. A denial of service flaw was found in the way Jenkins handled certain updat... • http://rhn.redhat.com/errata/RHSA-2015-1844.html • CWE-20: Improper Input Validation •

CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0

CVE-2015-1810 – jenkins: HudsonPrivateSecurityRealm allows creation of reserved names (SECURITY-166)

https://notcve.org/view.php?id=CVE-2015-1810

01 Oct 2015 — The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name. La clase HudsonPrivateSecurityRealm en Jenkins en versiones anteriores a 1.600 y LTS en versiones anteriores a 1.596.1 no restringe el acceso a nombres reservados cuando usan la configuración "base de datos de usuario propia Jenkins", lo que permite a at... • http://rhn.redhat.com/errata/RHSA-2015-1844.html • CWE-20: Improper Input Validation CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0

CVE-2015-1812 – jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://notcve.org/view.php?id=CVE-2015-1812

01 Oct 2015 — Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813. Vulnerabilidad de XSS en Jenkins en versiones anteriores a 1.606 y LTS en versiones anteriores a 1.596.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados, una vulnerabilidad diferente a CVE-2015-1813. Two cross-site sc... • http://rhn.redhat.com/errata/RHSA-2015-1844.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •