Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-1000079 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6. Additional Analyst Notes: - CVE Program C
stall a malicious gem. This vulnerability appears to have been fixed in 2.7.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4219 - https://usn.ubuntu.com/3621-1/ - https://access.redhat.com/errata/RHSA-2018:3729 - https://github.com/rubygems/rubygems/commit/666ef793cad42eed96f7aee1cdf77865db921099 - https://access.redhat.com/errata/RHSA-2018:3730 - https://access.redhat.com/errata/RHSA-2018:3731 - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html - https://www.debian.org/security/2018/dsa-4259 - https://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759 - http://blog.rubygems.org/2018/02/1
ttps://github.com/rubygems/rubygems/commit/f83f911e19e27cbac1ccce7471d96642241dd759 - http://blog.rubygems.org/2018/02/15/2.7.6-released.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://access.redhat.com/errata/RHSA-2019:2028 - https://access.redhat.com/errata/RHSA-2020:0542 - https://access.redhat.com/errata/RHSA-2020:0591 - https://access.redhat.com/errata/RHSA-2020:0663
CVE ID: CVE-2018-1000080 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ajenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The download of any plugins as being a normal user. This attack appear to be exploitable via By knowing how the requisition is made, and sending it as a normal user, the server, in response, downloads the plugin. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/stolabs/security-issues-on-ajenti-d2b7526eaeee
CVE ID: CVE-2018-1000081 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashing. This attack appear to be exploitable via An attacker can freeze te server by sending a giant string to the ID parameter .. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/stolabs/security-issues-on-ajenti-d2b7526eaeee
CVE ID: CVE-2018-1000082 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the tool used to manage the server. that can result in Code execution on the server . This attack appear to be exploitable via Being a CSRF, victim interaction is needed, when the victim access the infected trigger of the CSRF any code that match the victim privledges on the server can be executed.. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/stolabs/security-issues-on-
ecuted.. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/stolabs/security-issues-on-ajenti-d2b7526eaeee
CVE ID: CVE-2018-1000083 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The requisition leaks a path of the server. This attack appear to be exploitable via By sending a malformed JSON, the tool responds with a traceback error that leaks a path of the server. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/stolabs/security-issues-on-ajenti-d2b7526eaeee
CVE ID: CVE-2018-1000084 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: WOlfCMS WolfCMS version version 0.8.3.1 contains a Stored Cross-Site Scripting vulnerability in Layout Name (from Layout tab) that can result in low privilege user can steal the cookie of admin user and compromise the admin account. This attack appear to be exploitable via Need to enter the Javascript code into Layout Name . Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wolfcms/wolfcms/issues/667
CVE ID: CVE-2018-1000085 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains.. This attack appear to be exploitable via The victim must scan a crafted XAR file. This vulnerability appears to have been fixed in after commit d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3592-2/ - https://github.com/Cisco-Talos/clamav-de
Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3592-2/ - https://github.com/Cisco-Talos/clamav-devel/commit/d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6 - http://www.openwall.com/lists/oss-security/2017/09/29/4 - https://lists.debian.org/debian-lts-announce/2018/03/msg00011.html - https://usn.ubuntu.com/3592-1/ - https://security.gentoo.org/glsa/201804-16
CVE ID: CVE-2018-1000086 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function. https://github.com/nprapps/pym.js/blob/master/src/pym.js#L573 that can result in Arbitrary javascript code execution. This attack appear to be exploitable via Attacker gains full javascript access to pages with Pym.js embeds when user visits an attacker crafted page.. This vulnerability appears to have been fixed in versions 1.3.2 and later. Additional Analyst Notes: -
er crafted page.. This vulnerability appears to have been fixed in versions 1.3.2 and later. Additional Analyst Notes: - CVE Program Container: References: - http://blog.apps.npr.org/2018/02/15/pym-security-vulnerability.html - https://github.com/nprapps/pym.js/issues/170 - https://github.com/nprapps/pym.js
CVE ID: CVE-2018-1000087 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: WolfCMS version version 0.8.3.1 contains a Reflected Cross Site Scripting vulnerability in "Create New File" and "Create New Directory" input box from 'files' Tab that can result in Session Hijacking, Spread Worms,Control the browser remotely. . This attack appear to be exploitable via Attacker can execute the JavaScript into the "Create New File" and "Create New Directory" input box from 'files'. Additional Analyst Notes: - CVE Program Container: References: - https://cveexploit.blogspot.in/ - https://github.com/wolfcms/wo
al Analyst Notes: - CVE Program Container: References: - https://cveexploit.blogspot.in/ - https://github.com/wolfcms/wolfcms/issues/666
CVE ID: CVE-2018-1000088 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be exploitable via The victim must be tricked to click an opaque link to the web view that runs the XSS payload. A malicious version virtually indistinguishable from a normal link.. This vulnerability appears to have been fixed in 4.2.
malicious version virtually indistinguishable from a normal link.. This vulnerability appears to have been fixed in 4.2.6, 4.3.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rubysec/ruby-advisory-db/pull/328/files - https://github.com/doorkeeper-gem/doorkeeper/issues/969 - https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.3.0 - https://github.com/doorkeeper-gem/doorkeeper/pull/970
CVE ID: CVE-2018-1000089 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your Django error reports, an attacker could discover your ANYMAIL_WEBHOOK setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app. This vulnerability appears to have been fixed in v1.4. Addition
r malicious Anymail tracking/inbound events to your app. This vulnerability appears to have been fixed in v1.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anymail/django-anymail/commit/1a6086f2b58478d71f89bf27eb034ed81aefe5ef - https://github.com/anymail/django-anymail/releases/tag/v1.4
CVE ID: CVE-2018-1000090 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/textpattern/textpattern/issues/1141
CVE ID: CVE-2018-1000091 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: KadNode version version 2.2.0 contains a Buffer Overflow vulnerability in Arguments when starting up the binary that can result in Control of program execution flow, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mwarning/KadNode/issues/79
CVE ID: CVE-2018-1000092 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found here http://dev.cmsmadesimple.org/bug/view/11715. This attack appear to be exploitable via A specially crafted web page. This vulnerability appears to have been fixed in 2.2.6. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/11715
CVE ID: CVE-2018-1000093 State: PUBLISHED Published: 2018-03-13T15:00:00 Last Updated: 2024-08-05T12:33:49.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: CryptoNote version version 0.8.9 and possibly later contain a local RPC server which does not require authentication, as a result the walletd and the simplewallet RPC daemons will process any commands sent to them, resulting in remote command execution and a takeover of the cryptocurrency wallet if an attacker can trick an application such as a web browser into connecting and sending a command for example. This attack appears to be exploitable via a victim visiting a webpage hosting malicious content that trigger such behav
This attack appears to be exploitable via a victim visiting a webpage hosting malicious content that trigger such behavior. Additional Analyst Notes: - CVE Program Container: References: - https://www.ayrx.me/cryptonote-unauthenticated-json-rpc - https://github.com/cryptonotefoundation/cryptonote/issues/172 - https://github.com/amjuarez/bytecoin/issues/217
CVE ID: CVE-2018-1000094 State: PUBLISHED Published: 2018-03-13T01:00:00 Last Updated: 2024-08-05T12:33:49.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44976/ - http://dev.cmsmadesimple.org/bug/view/11741
CVE ID: CVE-2018-1000095 State: PUBLISHED Published: 2018-03-13T01:00:00 Last Updated: 2024-08-05T12:33:49.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: oVirt version 4.2.0 to 4.2.2 contains a Cross Site Scripting (XSS) vulnerability in the name/description of VMs portion of the web admin application. This vulnerability appears to have been fixed in version 4.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://gerrit.ovirt.org/#/c/87265/2/frontend/webadmin/modules/webadmin/src/main/java/org/ovirt/engine/ui/webadmin/widget/host/HostNetworkInterfaceListViewItem.java - https://gerrit.ovirt.org/c/87265/
CVE ID: CVE-2018-1000096 State: PUBLISHED Published: 2018-03-13T01:00:00 Last Updated: 2024-08-05T12:33:49.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL certificate validation vulnerability in The libraries core functionality is affected. that can result in Exposes the user to man-in-the-middle attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/brianleroux/tiny-json-http/pull/15
CVE ID: CVE-2018-1000097 State: PUBLISHED Published: 2018-03-13T01:00:00 Last Updated: 2024-08-05T12:33:49.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file.. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3605-1/ - https://www.debian.org/security/2018
lyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3605-1/ - https://www.debian.org/security/2018/dsa-4167 - http://seclists.org/bugtraq/2018/Feb/54
CVE ID: CVE-2018-1000098 State: PUBLISHED Published: 2018-03-13T01:00:00 Last Updated: 2024-08-05T12:33:49.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: Teluu PJSIP version 2.7.1 and earlier contains a Integer Overflow vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2. Additional Analyst Notes: - CVE Program Container: References: - https://trac.pjsip.org/repos/milestone/release-2.7.2 - https://trac.pjsip.org/repos/ticket/2093 - https://www.debian.org/security/2018/dsa-4170
CVE ID: CVE-2018-1000099 State: PUBLISHED Published: 2018-03-13T01:00:00 Last Updated: 2024-08-05T12:33:49.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: Teluu PJSIP version 2.7.1 and earlier contains a Access of Null/Uninitialized Pointer vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2. Additional Analyst Notes: - CVE Program Container: References: - https://trac.pjsip.org/repos/ticket/2094 - https://trac.pjsip.org/repos/milestone/release-2.7.2 - https://www.debian.org/security/2018/dsa-4170 - https://trac.pjsip.org/repos/ticket
.org/repos/milestone/release-2.7.2 - https://www.debian.org/security/2018/dsa-4170 - https://trac.pjsip.org/repos/ticket/2092
CVE ID: CVE-2018-1000100 State: PUBLISHED Published: 2018-03-06T17:00:00 Last Updated: 2024-08-05T12:33:49.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC MP4Box version 0.7.1 and earlier contains a Buffer Overflow vulnerability in src/isomedia/avc_ext.c lines 2417 to 2420 that can result in Heap chunks being modified, this could lead to RCE. This attack appear to be exploitable via an attacker supplied MP4 file that when run by the victim may result in RCE. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/994 - https://usn.ubuntu.com/3926-1/
CVE ID: CVE-2018-1000101 State: PUBLISHED Published: 2018-03-06T17:00:00 Last Updated: 2024-08-05T12:33:49.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mingw-w64 version 5.0.3 and earlier, 5.0.4, 6.0.0 and 7.0.0 contains an Improper Null Termination (CWE-170) vulnerability in mingw-w64-crt (libc)->(v)snprintf that can result in The bug may be used to corrupt subsequent string functions. This attack appear to be exploitable via Depending on the usage, worst case: network. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/mingw-w64/bugs/709/?limit=25#1d38/fefc/39aa - https://sourceforge.net/p/mingw-w64/mingw-w64/ci/v5.x/tree/mingw-w64
net/p/mingw-w64/bugs/709/?limit=25#1d38/fefc/39aa - https://sourceforge.net/p/mingw-w64/mingw-w64/ci/v5.x/tree/mingw-w64-crt/stdio/snprintf.c#l15 - https://sourceforge.net/p/mingw-w64/mingw-w64/ci/v5.x/tree/mingw-w64-crt/stdio/vsnprintf.c#l12 - https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2018/1000xxx/CVE-2018-1000101.json - https://sourceforge.net/p/mingw-w64/bugs/709/
CVE ID: CVE-2018-1000102 State: REJECTED Published: 2018-03-13T13:00:00Z Last Updated: 2024-09-16T16:53:05.137Z Description: No description available.
CVE ID: CVE-2018-1000103 State: REJECTED Published: 2018-03-13T13:00:00Z Last Updated: 2024-09-17T01:56:10.304Z Description: No description available.
CVE ID: CVE-2018-1000104 State: PUBLISHED Published: 2018-03-13T13:00:00Z Last Updated: 2024-09-16T22:40:16.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured keystore and private key passwords. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-26/#SECURITY-260
CVE ID: CVE-2018-1000105 State: PUBLISHED Published: 2018-03-13T13:00:00Z Last Updated: 2024-09-16T20:32:21.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to retrieve some configuration information about Gerrit in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-26/#SECURITY-402
CVE ID: CVE-2018-1000106 State: PUBLISHED Published: 2018-03-13T13:00:00Z Last Updated: 2024-09-17T03:49:01.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to modify the Gerrit configuration in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-26/#SECURITY-403
CVE ID: CVE-2018-1000107 State: PUBLISHED Published: 2018-03-13T13:00:00Z Last Updated: 2024-09-17T03:48:09.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins Job and Node Ownership Plugin 0.11.0 and earlier in OwnershipDescription.java, JobOwnerJobProperty.java, and OwnerNodeProperty.java that allow an attacker with Job/Configure or Computer/Configure permission and without Ownership related permissions to override ownership metadata. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-26/#SECURITY-498
CVE ID: CVE-2018-1000108 State: PUBLISHED Published: 2018-03-13T13:00:00Z Last Updated: 2024-09-16T20:06:26.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting vulnerability exists in Jenkins CppNCSS Plugin 1.1 and earlier in AbstractProjectAction/index.jelly that allow an attacker to craft links to Jenkins URLs that run arbitrary JavaScript in the user's browser when accessed. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-26/#SECURITY-712
CVE ID: CVE-2018-1000109 State: PUBLISHED Published: 2018-03-13T13:00:00Z Last Updated: 2024-09-17T03:07:31.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in GooglePlayBuildStepDescriptor.java that allow an attacker to obtain credential IDs. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-26/#SECURITY-715
CVE ID: CVE-2018-1000110 State: PUBLISHED Published: 2018-03-13T13:00:00Z Last Updated: 2024-09-16T18:13:30.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-26/#SECURITY-723
CVE ID: CVE-2018-1000111 State: PUBLISHED Published: 2018-03-13T13:00:00Z Last Updated: 2024-09-16T16:33:01.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and SubversionRepositoryStatus.java that allows an attacker with network access to obtain a list of nodes and users. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-26/#SECURITY-724
CVE ID: CVE-2018-1000112 State: PUBLISHED Published: 2018-03-13T13:00:00Z Last Updated: 2024-09-17T00:42:25.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an attacker with network access to obtain a list of nodes and users. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-02-26/#SECURITY-726