CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1003010
https://notcve.org/view.php?id=CVE-2019-1003010
06 Feb 2019 — A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record. Existe una vulnerabilidad Cross-Site Request Forgery (CSRF) en Jenkins Git Plugin, en versiones 3.9.1 y anteriores, en src/main/java/hudson/plugins/git/GitTagAction.java, que permite que los atacantes creen una etiqueta Git en un espacio de trabajo y adjunte... • https://access.redhat.com/errata/RHBA-2019:0326 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1003011
https://notcve.org/view.php?id=CVE-2019-1003011
06 Feb 2019 — An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the... • https://access.redhat.com/errata/RHBA-2019:0326 • CWE-674: Uncontrolled Recursion •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1003012
https://notcve.org/view.php?id=CVE-2019-1003012
06 Feb 2019 — A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cro... • https://access.redhat.com/errata/RHBA-2019:0326 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1003013
https://notcve.org/view.php?id=CVE-2019-1003013
06 Feb 2019 — An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/... • https://access.redhat.com/errata/RHBA-2019:0326 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1003014
https://notcve.org/view.php?id=CVE-2019-1003014
06 Feb 2019 — An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file. Existe una vulnerabilidad Cross-Site Scripting (XSS) en Jenkins Config File Provider Plugin, en versiones 3.4.1 y anteriores, en src/main/resources/lib/configfiles/configfiles.jelly, qu... • https://access.redhat.com/errata/RHBA-2019:0326 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-3818
https://notcve.org/view.php?id=CVE-2019-3818
05 Feb 2019 — The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowing for use of insecure ciphers and TLS 1.0. An attacker could target traffic sent over a TLS connection with a weak configuration and potentially break the encryption. El contenedor kube-rbac-proxy, en versiones anteriores a la 0.4.1, tal y como se utiliza en Red Hat OpenShift Container Platform, no cumple con las configuraciones TLS, permitiendo la utilización de cifra... • http://www.securityfocus.com/bid/106744 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 7.5EPSS: 0%CPEs: 23EXPL: 0CVE-2018-20615 – haproxy: Mishandling of priority flag in short HEADERS frame by HTTP/2 decoder allows for crash
https://notcve.org/view.php?id=CVE-2018-20615
05 Feb 2019 — An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing of the PRIORITY flag in a HEADERS frame requires 5 extra bytes, and while these bytes are skipped, the total frame length was not re-checked to make sure they were present in the frame. Se ha descubierto un problema de lectura fuera de límites en el decodificador del protocolo HTTP/2 en HAProxy, en versiones 1.8.x y 1.9.x hasta la 1.9.0, lo que puede ... • http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00018.html • CWE-125: Out-of-bounds Read •
CVSS: 3.3EPSS: 0%CPEs: 7EXPL: 0CVE-2019-3815 – systemd: memory leak in journald-server.c introduced by fix for CVE-2018-16864
https://notcve.org/view.php?id=CVE-2019-3815
28 Jan 2019 — A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2. Se descubrió una fuga de memoria en el "backport" de soluciones para CVE-2018-16864 en Red Hat Enterprise Linux. • http://www.securityfocus.com/bid/106632 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.2EPSS: 2%CPEs: 3EXPL: 0CVE-2019-1003003
https://notcve.org/view.php?id=CVE-2019-1003003
22 Jan 2019 — An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts. Existe una vulnerabilidad de autorización incorrecta en Jenkins, en la versión 2.158 y anteriores y con el firmware LTS 2.150.1 y anteriores, en ore/src/... • http://www.securityfocus.com/bid/106680 •
CVSS: 7.2EPSS: 1%CPEs: 3EXPL: 0CVE-2019-1003004
https://notcve.org/view.php?id=CVE-2019-1003004
22 Jan 2019 — An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time. Existe una vulnerabilidad de autorización incorrecta en Jenkins, en la versión 2.158 y anteriores con firmware LTS 2.150.1 y anteriores, en core/src/main/java/hudson/security/Authentica... • http://www.securityfocus.com/bid/106680 •