Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
t Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E - https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://bugs.eclipse.org/bugs/show_bug.cgi?id=546576 - https://security.netapp.com/advisory/ntap-20190509-0003/ - https://www.oracle.com/security
bugs/show_bug.cgi?id=546576 - https://security.netapp.com/advisory/ntap-20190509-0003/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html
CVE ID: CVE-2019-10247 State: PUBLISHED Published: 2019-04-22T20:14:49 Last Updated: 2024-08-04T22:17:19.834Z Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-213 Description: In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it
home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/519e
203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E - https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html
org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://security.netapp.com/advisory/ntap-20190509-0003/ - https://bugs.eclipse.org/bugs/show_bug.cgi?id=546577 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.debian.org/security/2021/dsa-4949 - https://www.oracle.com/security-alerts/
ecurity-alerts/cpuApr2021.html - https://www.debian.org/security/2021/dsa-4949 - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2019-10248 State: PUBLISHED Published: 2019-04-22T20:15:24 Last Updated: 2024-08-04T22:17:20.094Z Vendors: The Eclipse Foundation Products: Eclipse Vorto Problem Types: CWE-829, CWE-494 Description: Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be infected. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=546622
CVE ID: CVE-2019-10249 State: PUBLISHED Published: 2019-05-06T16:12:09 Last Updated: 2024-08-04T22:17:19.691Z Vendors: The Eclipse Foundation Products: Eclipse Xtext Problem Types: CWE-829, CWE-494 Description: All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=546996 - https://github.com/eclipse/xtext-xtend/issues/759
CVE ID: CVE-2019-10250 State: PUBLISHED Published: 2019-03-28T14:00:43 Last Updated: 2024-08-04T22:17:19.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.bleepingcomputer.com/news/security/uc-browser-for-android-desktop-exposes-500-million-users-to-mitm-attacks/
CVE ID: CVE-2019-10251 State: PUBLISHED Published: 2019-03-28T14:01:04 Last Updated: 2024-08-04T22:17:19.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files (related to libpicsel), which allows MITM attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.bleepingcomputer.com/news/security/uc-browser-for-android-desktop-exposes-500-million-users-to-mitm-attacks/ - https://news.drweb.com/show/?i=13176&c=38
CVE ID: CVE-2019-10253 State: PUBLISHED Published: 2019-09-09T20:51:39 Last Updated: 2024-08-04T22:17:19.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upload malicious/forged files on a TeamMate server, or replace existing uploaded files with malicious/forged files). The specific flaw exists within the handling of Upload/DomainObjectDocumentUpload.ashx requests because of failure to validate a CSRF token before handling a POST request. Additional Analyst Notes: - CVE Program Container: References: - http://www.teammatesolutions.com/ - http
POST request. Additional Analyst Notes: - CVE Program Container: References: - http://www.teammatesolutions.com/ - http://packetstormsecurity.com/files/154294/Wolters-Kluwer-TeamMate-3.1-Cross-Site-Request-Forgery.html
CVE ID: CVE-2019-10254 State: PUBLISHED Published: 2019-03-28T14:45:37 Last Updated: 2024-08-04T22:17:19.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/586cca384be6710b03e14bcbeb7588c1772604ec - https://github.com/MISP/MISP/compare/f493659...0e4f66e
CVE ID: CVE-2019-10255 State: PUBLISHED Published: 2019-03-28T15:30:39 Last Updated: 2024-08-04T22:17:19.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jupyter/notebook/commit/d65328d4841892b412aef9015165db1eb029a8ed - https://github.com/jupyter/notebook/commit/08c4c898182edbe97aadef1815cce50448
d65328d4841892b412aef9015165db1eb029a8ed - https://github.com/jupyter/notebook/commit/08c4c898182edbe97aadef1815cce50448f975cb - https://github.com/jupyter/notebook/commit/70fe9f0ddb3023162ece21fbb77d5564306b913b - https://github.com/jupyter/notebook/compare/05aa4b2...16cf97c - https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO/
CVE ID: CVE-2019-10256 State: PUBLISHED Published: 2019-09-10T18:02:45 Last Updated: 2024-08-04T22:17:19.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found. Additional Analyst Notes: - CVE Program Container: References: - https://www.vivotek.com/cybersecurity - http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2019-001-v1.pdf
CVE ID: CVE-2019-10257 State: PUBLISHED Published: 2019-06-19T13:51:46 Last Updated: 2024-08-04T22:17:19.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location (dot-dot-slash notation) to access files or directories that are elsewhere on the system. Through this vulnerability it is possible to read the application's java sources from /WEB-INF/classes/*.class Additional Analyst Notes: - CVE Program Container: References: - http://www.sk-it.com/en/cve.html
CVE ID: CVE-2019-10260 State: PUBLISHED Published: 2019-03-28T16:24:01 Last Updated: 2024-08-04T22:17:19.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/totaljs/cms/commit/8b9d7dada998c08d172481d9f0fc0397c4b3c78d - https://github.com/totaljs/cms/commit/75205f93009db3cf8c0b0f4f1fc8ab82d70da8ad
CVE ID: CVE-2019-10261 State: PUBLISHED Published: 2019-04-03T14:07:38 Last Updated: 2024-08-04T22:17:19.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46629 - https://packetstormsecurity.com/files/152303/CentOS-Web-Panel-0.9.8.789-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/107769
CVE ID: CVE-2019-10262 State: PUBLISHED Published: 2019-03-28T21:42:18 Last Updated: 2024-08-04T22:17:19.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection issue was discovered in BlueCMS 1.6. The variable $ad_id is spliced directly in uploads/admin/ad.php in the admin folder, and is not wrapped in single quotes, resulting in injection around the escape of magic quotes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/8test/pentest/issues/2
CVE ID: CVE-2019-10263 State: PUBLISHED Published: 2019-07-26T20:44:23 Last Updated: 2024-08-04T22:17:19.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When creating a trial account, it is possible to inject XSS in the Alias field, allowing the attacker to retrieve the admin's cookie and take over the account. Additional Analyst Notes: - CVE Program Container: References: - https://www.wbsec.nl/ahsay/
CVE ID: CVE-2019-10264 State: PUBLISHED Published: 2019-07-26T20:46:24 Last Updated: 2024-08-04T22:17:19.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. With a valid administrator account, the "Move / Import / Export Users" screen has an Import Users option. This option accepts a ZIP archive containing a users.xml file that can trigger XXE. Additional Analyst Notes: - CVE Program Container: References: - https://www.wbsec.nl/ahsay/
CVE ID: CVE-2019-10265 State: PUBLISHED Published: 2019-07-26T20:49:15 Last Updated: 2024-08-04T22:17:19.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. On the /cbs/system/ShowAdvanced.do "File Explorer" screen, it is possible to change the directory in the JavaScript code. If changed to (for example) "C:" then one can browse the whole server. Additional Analyst Notes: - CVE Program Container: References: - https://www.wbsec.nl/ahsay/
CVE ID: CVE-2019-10266 State: PUBLISHED Published: 2019-07-26T20:51:46 Last Updated: 2024-08-04T22:17:19.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file structure and even the content of files without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.wbsec.nl/ahsay/ - http://packetstormsecurity.com/files/153772/Ahsay-Backup-7.x-8.x-XML-Injection.html
CVE ID: CVE-2019-10267 State: PUBLISHED Published: 2019-07-26T20:53:37 Last Updated: 2024-08-04T22:17:19.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the configured user (e.g., Administrator). Additional Analyst Notes: - CVE Program Container: References: - https://www.wbsec.nl/ahsay/ - http://packetstormsecurity.com/files/153771/Ahsay-Backup-7.x-8.x-File-Upload-Remote-Code-Execution.html -
c.nl/ahsay/ - http://packetstormsecurity.com/files/153771/Ahsay-Backup-7.x-8.x-File-Upload-Remote-Code-Execution.html - http://packetstormsecurity.com/files/153770/Ahsay-Backup-7.x-8.x-File-Upload-Remote-Code-Execution.html
CVE ID: CVE-2019-10268 State: REJECTED Published: 2019-04-03T17:05:41 Last Updated: 2019-04-03T17:05:41 Description: No description available.
CVE ID: CVE-2019-10269 State: PUBLISHED Published: 2019-03-29T04:54:04 Last Updated: 2024-08-04T22:17:20.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lh3/bwa/pull/232 - https://coreymhudson.github.io/bwa_vulnerabilties/ - https://usn.ubuntu.com/4087-1/
CVE ID: CVE-2019-10270 State: PUBLISHED Published: 2019-06-21T17:44:51 Last Updated: 2024-08-04T22:17:19.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset the password of another user. One only needs to know the user_id, which is publicly available. One just has to intercept the password modification request and modify user_id. It is possible to modify the passwords for any users or admin WordPress Ultimate Members. This could lead to account
d. It is possible to modify the passwords for any users or admin WordPress Ultimate Members. This could lead to account compromise and privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2019060101
CVE ID: CVE-2019-10271 State: PUBLISHED Published: 2019-06-24T18:11:59 Last Updated: 2024-08-04T22:17:19.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged users. To perform such a modification, one first needs to (for example) intercept an upload-picture request and modify the user_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WL
the user_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2019060120
CVE ID: CVE-2019-10272 State: PUBLISHED Published: 2019-04-30T17:47:05 Last Updated: 2024-08-04T22:17:19.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Weaver e-cology 9.0. There is a CRLF Injection vulnerability via the /workflow/request/ViewRequestForwardSPA.jsp isintervenor parameter, as demonstrated by the %0aSet-cookie: substring. Additional Analyst Notes: - CVE Program Container: References: - https://www.weaver.com.cn/cs/securityDownload.asp - https://expzh.com/Weaver-e-cology9.0-CRLF-Injection.pdf
CVE ID: CVE-2019-10273 State: PUBLISHED Published: 2019-04-04T15:36:47 Last Updated: 2024-08-04T22:17:19.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account. Additional Analyst Notes: - CVE Program Container: References: - https://0x445.github.io/CVE-2019-10273/ - https://www.exploit-db.com/exploits/46674/ - http://packetstormsecurity.com/files/152439/ManageEngine-ServiceDesk-Plus-9.3-User-Enumeration.html
CVE ID: CVE-2019-10276 State: PUBLISHED Published: 2019-03-29T06:06:31 Last Updated: 2024-08-04T22:17:19.742Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Bridge Cobub Razor 0.8.0 has a file upload vulnerability via the web/assets/swf/uploadify.php URI, as demonstrated by a .php file with the image/jpeg content type. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cobub/razor/issues/168 - https://github.com/kyrie403/Vuln/blob/master/Cobub%20Razor/Cobub%20Razor%20-%20file%20upload%20vulnerability.md
CVE ID: CVE-2019-10277 State: PUBLISHED Published: 2019-04-04T15:38:49 Last Updated: 2024-08-04T22:17:19.896Z Vendors: Jenkins project Products: Jenkins StarTeam Plugin Description: Jenkins StarTeam Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1085
CVE ID: CVE-2019-10278 State: PUBLISHED Published: 2019-04-04T15:38:49 Last Updated: 2024-08-04T22:17:19.811Z Vendors: Jenkins project Products: Jenkins jenkins-reviewbot Plugin Description: A cross-site request forgery vulnerability in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1091
CVE ID: CVE-2019-10279 State: PUBLISHED Published: 2019-04-04T15:38:49 Last Updated: 2024-08-04T22:17:19.742Z Vendors: Jenkins project Products: Jenkins jenkins-reviewbot Plugin Description: A missing permission check in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1091
CVE ID: CVE-2019-10280 State: PUBLISHED Published: 2019-04-04T15:38:49 Last Updated: 2024-08-04T22:17:19.965Z Vendors: Jenkins project Products: Jenkins Assembla Auth Plugin Description: Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1093
CVE ID: CVE-2019-10281 State: PUBLISHED Published: 2019-04-04T15:38:49 Last Updated: 2024-08-04T22:17:20.161Z Vendors: Jenkins project Products: Jenkins Relution Enterprise Appstore Publisher Plugin Description: Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-828
CVE ID: CVE-2019-10282 State: PUBLISHED Published: 2019-04-04T15:38:49 Last Updated: 2024-08-04T22:17:19.594Z Vendors: Jenkins project Products: Jenkins Klaros-Testmanagement Plugin Description: Jenkins Klaros-Testmanagement Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-843
CVE ID: CVE-2019-10283 State: PUBLISHED Published: 2019-04-04T15:38:49 Last Updated: 2024-08-04T22:17:19.616Z Vendors: Jenkins project Products: Jenkins mabl Plugin Description: Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-946
CVE ID: CVE-2019-10284 State: PUBLISHED Published: 2019-04-04T15:38:49 Last Updated: 2024-08-04T22:17:19.859Z Vendors: Jenkins project Products: Jenkins Diawi Upload Plugin Description: Jenkins Diawi Upload Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-947
CVE ID: CVE-2019-10285 State: PUBLISHED Published: 2019-04-04T15:38:49 Last Updated: 2024-08-04T22:17:19.980Z Vendors: Jenkins project Products: Jenkins Minio Storage Plugin Description: Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-955