WaratekVRT Sign in
Reset
More filters (2)
Columns
Protection: None✕Published to 2019-12-31✕
Overview 5,027 matches · 0 protected · 23 exploited · 0 CISA KEV · 199 public PoC · 63 EPSS ≥ 0.5
5,027matches 0protected0.0% 23exploited0.5% 0CISA KEV0.0% 199public PoC4.0% 63EPSS ≥ 0.51.3%
Protected by Waratek 0 0.0% Rule in development 1 0.0% Mitigation candidate 206 4.1% No exploit published 4,820 95.9%
Critical 162 3.2% High 1,385 27.6% Medium 3,042 60.5% Low 438 8.7% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 5,027 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 23 0.5% Working exploit published 178 3.5% Proof of concept only 5 0.1% Forecast only 8 0.2% No public exploit 4,813 95.7%
split by peak 780 / year
No exploit published: 4,820Mitigation candidate: 206Rule in development: 1 Low: 438Medium: 3,042High: 1,385Critical: 162 not blocked: 5,027 No public exploit: 4,813Forecast only: 8Proof of concept only: 5Working exploit published: 178Exploited: 23
19961 No exploit published1 High1 not blocked1 No public exploit1 19970 19980 19992 No exploit published2 High2 not blocked2 No public exploit2 200012 Mitigation candidate6 No exploit published6 High5 Medium7 not blocked12 Working exploit published6 No public exploit6 200112 Mitigation candidate2 No exploit published10 High6 Medium6 not blocked12 Working exploit published2 No public exploit10 200234 Mitigation candidate8 No exploit published26 High10 Medium21 Low3 not blocked34 Working exploit published8 Forecast only2 No public exploit24 200337 Mitigation candidate7 No exploit published30 High9 Medium22 Low6 not blocked37 Working exploit published7 No public exploit30 200425 Mitigation candidate1 No exploit published24 High5 Medium17 Low3 not blocked25 Working exploit published1 No public exploit24 200579 Mitigation candidate4 No exploit published75 Critical1 High30 Medium43 Low5 not blocked79 Working exploit published4 No public exploit75 2006125 Mitigation candidate4 No exploit published121 High62 Medium52 Low11 not blocked125 Working exploit published4 No public exploit121 2007144 Mitigation candidate10 No exploit published134 High65 Medium69 Low10 not blocked144 Working exploit published10 No public exploit134 2008129 Mitigation candidate9 No exploit published120 High43 Medium79 Low7 not blocked129 Working exploit published9 No public exploit120 2009194 Mitigation candidate13 No exploit published181 High49 Medium124 Low21 not blocked194 Exploited1 Working exploit published12 No public exploit181 2010174 Mitigation candidate12 No exploit published162 High25 Medium127 Low22 not blocked174 Exploited1 Working exploit published11 Forecast only1 No public exploit161 2011187 Mitigation candidate9 No exploit published178 High19 Medium135 Low33 not blocked187 Working exploit published9 No public exploit178 2012300 Mitigation candidate22 No exploit published278 High27 Medium193 Low80 not blocked300 Exploited3 Working exploit published19 No public exploit278 2013322 Mitigation candidate17 No exploit published305 High33 Medium236 Low53 not blocked322 Exploited2 Working exploit published14 Forecast only1 No public exploit305 2014294 Mitigation candidate12 No exploit published282 High21 Medium224 Low49 not blocked294 Exploited2 Working exploit published10 No public exploit282 2015291 Mitigation candidate6 No exploit published285 Critical1 High34 Medium206 Low50 not blocked291 Exploited1 Working exploit published4 Proof of concept only1 No public exploit285 2016476 Mitigation candidate11 No exploit published465 Critical33 High115 Medium295 Low33 not blocked476 Working exploit published11 Forecast only1 No public exploit464 2017696 Mitigation candidate14 No exploit published682 Critical46 High297 Medium331 Low22 not blocked696 Exploited4 Working exploit published8 Proof of concept only2 Forecast only1 No public exploit681 2018713 Mitigation candidate16 No exploit published697 Critical35 High232 Medium436 Low10 not blocked713 Exploited3 Working exploit published12 Proof of concept only1 No public exploit697 2019780 Rule in development1 Mitigation candidate23 No exploit published756 Critical46 High295 Medium419 Low20 not blocked780 Exploited6 Working exploit published17 Proof of concept only1 Forecast only2 No public exploit754
199719992001200320052007200920112013201520172019
5,027 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 51 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2019-6035 Medium 2019-12-26 No exploit published No public exploit Open redirect vulnerability in Athenz v1.8.24 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page.
CVE-2012-4420 High 2019-12-26 No exploit published No public exploit An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.
CVE-2019-12418 High 2019-12-23 No exploit published No public exploit When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
CVE-2012-2312 High 2019-12-18 No exploit published No public exploit An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated privileges.
CVE-2019-16576 Medium 2019-12-17 No exploit published No public exploit A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins.
CVE-2019-16575 High 2019-12-17 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins.
CVE-2019-16574 Medium 2019-12-17 No exploit published No public exploit A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-16573 High 2019-12-17 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-16572 Medium 2019-12-17 No exploit published No public exploit Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVE-2019-16571 Medium 2019-12-17 No exploit published No public exploit A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server.
CVE-2019-16570 High 2019-12-17 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specified web server.
CVE-2019-16569 Medium 2019-12-17 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified web server using attacker-specified credentials.
CVE-2019-16568 Medium 2019-12-17 No exploit published No public exploit Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as individual jobs' configurations.
CVE-2019-16567 Medium 2019-12-17 No exploit published No public exploit A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVE-2019-16566 Medium 2019-12-17 No exploit published No public exploit A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-16565 High 2019-12-17 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-16564 Medium 2019-12-17 No exploit published No public exploit Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to affects view content such as job display name or pipeline stage names.
CVE-2019-16563 Medium 2019-12-17 No exploit published No public exploit Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to change these properties.
CVE-2019-16562 Medium 2019-12-17 No exploit published No public exploit Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS vulnerability exploitable by users able to change build descriptions.
CVE-2019-16561 High 2019-12-17 No exploit published No public exploit Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM.
CVE-2019-16560 High 2019-12-17 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.
CVE-2019-16559 Medium 2019-12-17 No exploit published No public exploit A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.
CVE-2019-16558 High 2019-12-17 No exploit published No public exploit Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM.
CVE-2019-16557 Medium 2019-12-17 No exploit published No public exploit Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVE-2019-16556 Medium 2019-12-17 No exploit published No public exploit Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVE-2019-16555 Medium 2019-12-17 No exploit published No public exploit A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process.
CVE-2019-16554 Medium 2019-12-17 No exploit published No public exploit A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.
CVE-2019-16553 High 2019-12-17 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression.
CVE-2019-16552 Medium 2019-12-17 No exploit published No public exploit A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins master.
CVE-2019-16551 High 2019-12-17 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials.
CVE-2019-16550 High 2019-12-17 No exploit published No public exploit A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents.
CVE-2014-3652 Medium 2019-12-15 No exploit published No public exploit JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.
CVE-2013-6495 Medium 2019-12-11 No exploit published No public exploit JBossWeb Bayeux has reflected XSS
CVE-2019-4663 Medium 2019-12-10 No exploit published No public exploit IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171245.
CVE-2019-19703 Medium 2019-12-10 No exploit published No public exploit In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.
CVE-2014-3656 Medium 2019-12-10 No exploit published No public exploit JBoss KeyCloak: XSS in login-status-iframe.html
CVE-2019-16771 Medium 2019-12-06 No exploit published No public exploit Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in 0.97.0. Potential impacts of this vulnerability include cross-user defacement, cache poisoning, Cross-site scripting (XSS), and page hijacking.
CVE-2012-2148 Low 2019-12-06 No exploit published No public exploit An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies
CVE-2019-14910 Critical 2019-12-05 No exploit published No public exploit A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.
CVE-2012-1592 High 2019-12-05 Mitigation candidate Working exploit published A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
CVE-2019-17555 High 2019-12-04 No exploit published No public exploit The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header, then it can help to implement a DoS attack.
CVE-2019-14909 High 2019-12-04 No exploit published No public exploit A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.
CVE-2019-17632 Medium 2019-11-25 No exploit published No public exploit In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.
CVE-2015-1780 Medium 2019-11-22 No exploit published No public exploit oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center
CVE-2019-16543 Medium 2019-11-21 No exploit published No public exploit Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVE-2019-16542 Medium 2019-11-21 No exploit published No public exploit Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVE-2019-16539 Medium 2019-11-21 No exploit published No public exploit A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles.
CVE-2019-16538 High 2019-11-21 No exploit published No public exploit A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.
CVE-2019-12421 High 2019-11-19 No exploit published No public exploit When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.
CVE-2019-10083 Medium 2019-11-19 No exploit published No public exploit When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.
CVE-2019-12422 High 2019-11-18 No exploit published No public exploit Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
CVE-2019-12409 Critical 2019-11-18 Mitigation candidate Proof of concept only The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.
CVE-2019-10070 Medium 2019-11-18 No exploit published No public exploit Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality
CVE-2012-4441 Medium 2019-11-18 No exploit published No public exploit Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin.
CVE-2012-4440 Medium 2019-11-18 No exploit published No public exploit Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the Violations plugin.
CVE-2012-4439 Medium 2019-11-18 No exploit published No public exploit Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins.
CVE-2012-4438 High 2019-11-18 No exploit published No public exploit Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code.
CVE-2019-19040 Medium 2019-11-17 No exploit published No public exploit KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>' substring.
CVE-2019-3641 Medium 2019-11-13 No exploit published No public exploit Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server (TIE Server) 3.0.0 allows remote authenticated users to modify stored reputation data via specially crafted messages.
CVE-2014-3655 Medium 2019-11-13 No exploit published No public exploit JBoss KeyCloak is vulnerable to soft token deletion via CSRF
CVE-2010-3857 Medium 2019-11-12 No exploit published No public exploit JBoss BRMS before 5.1.0 has a XSS vulnerability via asset=UUID parameter.
CVE-2008-5083 Medium 2019-11-08 No exploit published No public exploit In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBoss ON.
CVE-2019-12419 Critical 2019-11-06 No exploit published No public exploit Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
CVE-2019-12406 Medium 2019-11-06 No exploit published No public exploit Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".
CVE-2009-5049 Medium 2019-11-06 No exploit published No public exploit WebApp JSP Snoop page XSS in jetty though 6.1.21.
CVE-2009-5048 Medium 2019-11-06 No exploit published No public exploit Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20.
CVE-2009-5046 Medium 2019-11-06 No exploit published No public exploit JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.
CVE-2009-5045 High 2019-11-06 No exploit published No public exploit Dump Servlet information leak in jetty before 6.1.22.
CVE-2019-17598 High 2019-11-05 No exploit published No public exploit An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host.
CVE-2013-4374 High 2019-11-04 No exploit published No public exploit An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files.
CVE-2013-4367 High 2019-11-01 No exploit published No public exploit ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.chmod() works when passed a mode of '-1'.
CVE-2011-3923 Critical 2019-11-01 Mitigation candidate Exploited Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CVE-2019-7619 Medium 2019-10-30 No exploit published No public exploit Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm.
CVE-2010-0737 High 2019-10-30 No exploit published No public exploit A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permissions, which allows JBoss ON users to perform management tasks and configuration changes with the privileges of the administrator user.
CVE-2019-0210 High 2019-10-29 No exploit published No public exploit In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.
CVE-2019-0205 High 2019-10-29 No exploit published No public exploit In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.
CVE-2012-2945 High 2019-10-29 No exploit published No public exploit Hadoop 1.0.3 contains a symlink vulnerability.
CVE-2019-18394 Critical 2019-10-24 Rule in development Exploited A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.
CVE-2019-10476 High 2019-10-23 No exploit published No public exploit Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
CVE-2019-10475 Medium 2019-10-23 Mitigation candidate Working exploit published A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
CVE-2019-10474 Medium 2019-10-23 No exploit published No public exploit A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to the plugin stored on the Jenkins master file system.
CVE-2019-10473 Medium 2019-10-23 No exploit published No public exploit A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVE-2019-10472 Medium 2019-10-23 No exploit published No public exploit A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-10471 High 2019-10-23 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-10470 Medium 2019-10-23 No exploit published No public exploit A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVE-2019-10469 Medium 2019-10-23 No exploit published No public exploit A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-10468 High 2019-10-23 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-10467 Medium 2019-10-23 No exploit published No public exploit Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVE-2019-10465 Medium 2019-10-23 No exploit published No public exploit A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials, or determine whether a file or directory with an attacker-specified path exists on the Jenkins master file system.
CVE-2019-10464 High 2019-10-23 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins Deploy WebLogic Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials, or determine whether a file or directory with an attacker-specified path exists on the Jenkins master file system.
CVE-2019-10463 Medium 2019-10-23 No exploit published No public exploit A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2019-10462 High 2019-10-23 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2019-10461 High 2019-10-23 No exploit published No public exploit Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
CVE-2019-10460 High 2019-10-23 No exploit published No public exploit Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
CVE-2019-10459 Medium 2019-10-23 No exploit published No public exploit Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
CVE-2019-16530 High 2019-10-21 No exploit published No public exploit Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.
CVE-2019-17513 High 2019-10-18 No exploit published No public exploit An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
CVE-2019-17631 Critical 2019-10-17 No exploit published No public exploit From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks.
CVE-2019-11284 High 2019-10-17 No exploit published No public exploit Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
CVE-2019-3027 Medium 2019-10-16 No exploit published No public exploit Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login Help). Supported versions that are affected are 12.2.5-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Object Library. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
‹ prev page 1 of 51 next ›