Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kubernetes/kubernetes/pull/75037 - http://www.securityfocus.com/bid/107652 - https://access.redhat.com/errata/RHBA-2019:0620 - https://access.redhat.com/errata/RHBA-2019:0619 - https://access.redhat.com/errata/RHBA-2019:0636 - https://lists.fedoraproject.org/archives/list/
errata/RHBA-2019:0619 - https://access.redhat.com/errata/RHBA-2019:0636 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPV2RE5RMOGUVP5WJMXKQJZUBBLAFZPZ/ - http://www.openwall.com/lists/oss-security/2019/06/21/1 - http://www.openwall.com/lists/oss-security/2019/08/05/5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QZB7E3DOZ5WDG46XAIU6K32CXHXPXB2F/ - https://www.twistlock.com/labs-blog/disclosing-directory-traversal-vulnerability-kubernetes-copy-cve-2019-1002101/
CVE ID: CVE-2019-1003000 State: PUBLISHED Published: 2019-01-22T14:00:00 Last Updated: 2024-08-05T03:00:19.257Z Vendors: Jenkins project Products: Script Security Plugin Description: A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266 - https://www.exploit-db.com/exploits/46453/ - https://access.redhat.com/errata/RHBA-2019:0326 - ht
01-08/#SECURITY-1266 - https://www.exploit-db.com/exploits/46453/ - https://access.redhat.com/errata/RHBA-2019:0326 - http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html - http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming - https://www.exploit-db.com/exploits/46572/ - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2019-1003001 State: PUBLISHED Published: 2019-01-22T14:00:00 Last Updated: 2024-08-05T03:00:19.299Z Vendors: Jenkins project Products: Pipeline: Groovy Plugin Description: A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-0
ter JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266 - https://access.redhat.com/errata/RHBA-2019:0326 - http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html - http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming - https://www.exploit-db.com/exploits/46572/ - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2019-1003002 State: PUBLISHED Published: 2019-01-22T14:00:00 Last Updated: 2024-08-05T03:00:19.322Z Vendors: Jenkins project Products: Pipeline: Declarative Plugin Description: A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266 - https:
st Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266 - https://access.redhat.com/errata/RHBA-2019:0326 - http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html - http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming - https://www.exploit-db.com/exploits/46572/ - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2019-1003003 State: PUBLISHED Published: 2019-01-22T14:00:00 Last Updated: 2024-08-05T03:00:19.280Z Vendors: Jenkins project Products: Jenkins Description: An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-16/#SECURITY-868 - http://www.securityfocus.com/bid/106680 - ht
ferences: - https://jenkins.io/security/advisory/2019-01-16/#SECURITY-868 - http://www.securityfocus.com/bid/106680 - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2019-1003004 State: PUBLISHED Published: 2019-01-22T14:00:00 Last Updated: 2024-08-05T03:00:19.430Z Vendors: Jenkins project Products: Jenkins Description: An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-16/#SECURITY-901 - http://www.securityfocus.com/bid/106680 - https://access.redhat.com/errata/R
ecurity/advisory/2019-01-16/#SECURITY-901 - http://www.securityfocus.com/bid/106680 - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2019-1003005 State: PUBLISHED Published: 2019-02-06T16:00:00 Last Updated: 2024-08-05T03:00:19.239Z Vendors: Jenkins project Products: Jenkins Script Security Plugin Description: A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1292 - https://access.redhat.com/er
m Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1292 - https://access.redhat.com/errata/RHSA-2019:0739 - http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html
CVE ID: CVE-2019-1003006 State: PUBLISHED Published: 2019-02-06T16:00:00Z Last Updated: 2024-09-16T20:21:57.957Z Vendors: Jenkins project Products: Jenkins Groovy Plugin Description: A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1293
CVE ID: CVE-2019-1003007 State: PUBLISHED Published: 2019-02-06T16:00:00Z Last Updated: 2024-09-17T03:08:27.801Z Vendors: Jenkins project Products: Jenkins Warnings Plugin Description: A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1295%20%281%29
CVE ID: CVE-2019-1003008 State: PUBLISHED Published: 2019-02-06T16:00:00Z Last Updated: 2024-09-17T00:21:22.209Z Vendors: Jenkins project Products: Jenkins Warnings Next Generation Plugin Description: A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1295%20%282%29
CVE ID: CVE-2019-1003009 State: PUBLISHED Published: 2019-02-06T16:00:00Z Last Updated: 2024-09-16T18:08:16.833Z Vendors: Jenkins project Products: Jenkins Active Directory Plugin Description: An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS. Ad
ersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-859
CVE ID: CVE-2019-1003010 State: PUBLISHED Published: 2019-02-06T16:00:00 Last Updated: 2024-08-05T03:00:19.322Z Vendors: n/a Products: n/a Description: A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1095 - https://access.redhat.com/errata/RHBA-2019:0326 - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2019-1003011 State: PUBLISHED Published: 2019-02-06T16:00:00 Last Updated: 2024-08-05T03:00:19.329Z Vendors: Jenkins project Products: Jenkins Token Macro Plugin Description: An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the
uildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102 - https://access.redhat.com/errata/RHBA-2019:0326 - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2019-1003012 State: PUBLISHED Published: 2019-02-06T16:00:00 Last Updated: 2024-08-05T03:00:19.427Z Vendors: Jenkins project Products: Jenkins Blue Ocean Plugins Description: A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cros
, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1201 - https://access.redhat.com/errata/RHBA-2019:0326 - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2019-1003013 State: PUBLISHED Published: 2019-02-06T16:00:00 Last Updated: 2024-08-05T03:00:19.473Z Vendors: Jenkins project Products: Jenkins Blue Ocean Plugins Description: An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/b
c/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHBA-2019:0326 - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1204 - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2019-1003014 State: PUBLISHED Published: 2019-02-06T16:00:00 Last Updated: 2024-08-05T03:00:19.351Z Vendors: Jenkins project Products: Jenkins Config File Provider Plugin Description: An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1253 - https://access.redhat.com/errata/RHBA-2019:0326
nces: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1253 - https://access.redhat.com/errata/RHBA-2019:0326 - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2019-1003015 State: PUBLISHED Published: 2019-02-06T16:00:00Z Last Updated: 2024-09-16T18:49:29.812Z Vendors: Jenkins project Products: Jenkins Job Import Plugin Description: An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server (Jenkins) queried in preparation of job import to read arbitrary files, perform a denial of service attack, etc. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20%281%29
CVE ID: CVE-2019-1003016 State: PUBLISHED Published: 2019-02-06T16:00:00Z Last Updated: 2024-09-16T17:15:19.836Z Vendors: Jenkins project Products: Jenkins Job Import Plugin Description: An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalConfig.java, src/main/java/org/jenkins/ci/plugins/jobimport/model/JenkinsSite.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing crede
t to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20%282%29
CVE ID: CVE-2019-1003017 State: PUBLISHED Published: 2019-02-06T16:00:00Z Last Updated: 2024-09-17T02:26:18.483Z Vendors: Jenkins project Products: Jenkins Job Import Plugin Description: A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job's configuration. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1302
CVE ID: CVE-2019-1003018 State: PUBLISHED Published: 2019-02-06T16:00:00Z Last Updated: 2024-09-16T20:43:31.251Z Vendors: Jenkins project Products: Jenkins GitHub Authentication Plugin Description: An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-602
CVE ID: CVE-2019-1003019 State: PUBLISHED Published: 2019-02-06T16:00:00Z Last Updated: 2024-09-16T20:37:33.126Z Vendors: Jenkins project Products: Jenkins GitHub Authentication Plugin Description: An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-797
CVE ID: CVE-2019-1003020 State: PUBLISHED Published: 2019-02-06T16:00:00Z Last Updated: 2024-09-17T00:31:13.873Z Vendors: Jenkins project Products: Jenkins Kanboard Plugin Description: A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that allows attackers with Overall/Read permission to submit a GET request to an attacker-specified URL. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-818
CVE ID: CVE-2019-1003021 State: PUBLISHED Published: 2019-02-06T16:00:00Z Last Updated: 2024-09-17T01:21:38.210Z Vendors: Jenkins project Products: Jenkins OpenId Connect Authentication Plugin Description: An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-886
CVE ID: CVE-2019-1003022 State: PUBLISHED Published: 2019-02-06T16:00:00Z Last Updated: 2024-09-16T23:55:36.914Z Vendors: Jenkins project Products: Jenkins Monitoring Plugin Description: A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1153
CVE ID: CVE-2019-1003023 State: PUBLISHED Published: 2019-02-06T16:00:00Z Last Updated: 2024-09-17T00:21:48.417Z Vendors: Jenkins project Products: Jenkins Warnings Next Generation Plugin Description: A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourcePrinter.java, src/main/java/io/jenkins/plugins/analysis/core/util/Sanitizer.java, src/main/java/io/jenkins/plugins/analysis/warnings/DuplicateCodeScanner.java that allows attackers wi
il/Sanitizer.java, src/main/java/io/jenkins/plugins/analysis/warnings/DuplicateCodeScanner.java that allows attackers with the ability to control warnings parser input to have Jenkins render arbitrary HTML. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1271
CVE ID: CVE-2019-1003024 State: PUBLISHED Published: 2019-02-20T21:00:00 Last Updated: 2024-08-05T03:00:19.284Z Vendors: Jenkins project Products: Jenkins Script Security Plugin Description: A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-02-19/#SECURITY-1320 - http://www.securityfocus.com/bid/107295 - https://access.redhat.com/errata/RHSA-201
advisory/2019-02-19/#SECURITY-1320 - http://www.securityfocus.com/bid/107295 - https://access.redhat.com/errata/RHSA-2019:0739
CVE ID: CVE-2019-1003025 State: PUBLISHED Published: 2019-02-20T21:00:00 Last Updated: 2024-08-05T03:00:19.433Z Vendors: Jenkins project Products: Jenkins Cloud Foundry Plugin Description: A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-02-19/#SECURITY-876 - http://www.securityfocus.com/b
Container: References: - https://jenkins.io/security/advisory/2019-02-19/#SECURITY-876 - http://www.securityfocus.com/bid/107295
CVE ID: CVE-2019-1003026 State: PUBLISHED Published: 2019-02-20T21:00:00 Last Updated: 2024-08-05T03:00:19.310Z Vendors: Jenkins project Products: Jenkins Mattermost Notification Plugin Description: A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and room and send a message. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-02-19/#SECURITY-985 - http://www.securityfocus.com/bid/107295
CVE ID: CVE-2019-1003027 State: PUBLISHED Published: 2019-02-20T21:00:00 Last Updated: 2024-08-05T03:00:19.287Z Vendors: Jenkins project Products: Jenkins OctopusDeploy Plugin Description: A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL and obtain the HTTP response code if successful, and exception error message otherwise. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-02-19/#SECURITY-817 - http://www.securityfocus.com/bid/107295