Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-1000139 State: PUBLISHED Published: 2018-03-23T21:00:00Z Last Updated: 2024-09-16T19:25:09.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: I, Librarian version 4.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in "id" parameter in stable.php that can result in an attacker using the XSS to send a malicious script to an unsuspecting user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mkucej/i-librarian/blob/9535753a84bc615b210802d4c9542db73368d984/stable.php#L8 - https://github.com/mkucej/i-librarian/issues/119
CVE ID: CVE-2018-1000140 State: PUBLISHED Published: 2018-03-23T00:00:00 Last Updated: 2024-08-05T12:33:49.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3612-1/ - https://security.gentoo.org/glsa/201804-21 - https://github.com/rsyslog/librelp/blob/532
ttps://usn.ubuntu.com/3612-1/ - https://security.gentoo.org/glsa/201804-21 - https://github.com/rsyslog/librelp/blob/532aa362f0f7a8d037505b0a27a1df452f9bac9e/src/tcp.c#L1205 - https://access.redhat.com/errata/RHSA-2018:1703 - https://access.redhat.com/errata/RHSA-2018:1704 - https://access.redhat.com/errata/RHSA-2018:1702 - https://access.redhat.com/errata/RHSA-2018:1225 - https://access.redhat.com/errata/RHSA-2018:1707 - https://lgtm.com/rules/1505913226124/ - https://access.redhat.com/errata/RHSA-2018:1223 - https://www.debian.org/security/2018/dsa-4151 - https://access.redhat.com/errata/RHSA-2018:1701 - http://packetstormsecurity.com/files/172829/librelp-Remote-Code-Execution.html
CVE ID: CVE-2018-1000141 State: PUBLISHED Published: 2018-03-23T21:00:00Z Last Updated: 2024-09-16T23:02:04.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users gaining unauthorized access (read, write and delete) to project discussions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mkucej/i-librarian/issues/124
CVE ID: CVE-2018-1000142 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-16T20:16:33.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-03-26/#SECURITY-261
CVE ID: CVE-2018-1000143 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-16T19:40:27.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-03-26/#SECURITY-262
CVE ID: CVE-2018-1000144 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-17T04:00:21.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross site scripting vulnerability exists in Jenkins Cucumber Living Documentation Plugin 1.0.12 and older in CukedoctorBaseAction#doDynamic that disables the Content-Security-Policy protection for archived artifacts and workspace files, allowing attackers able to control the content of these files to attack Jenkins users. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-03-26/#SECURITY-308
CVE ID: CVE-2018-1000145 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-16T20:03:07.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with local file system access to obtain encrypted Perforce passwords and decrypt them. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-03-26/#SECURITY-373
CVE ID: CVE-2018-1000146 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-16T19:31:43.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-03-26/#SECURITY-519
CVE ID: CVE-2018-1000147 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-16T17:42:53.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with insufficient permission to obtain Perforce passwords configured in jobs to obtain them Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-03-26/#SECURITY-536
CVE ID: CVE-2018-1000148 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-16T18:55:58.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exposure of sensitive information vulnerability exists in Jenkins Copy To Slave Plugin version 1.4.4 and older in CopyToSlaveBuildWrapper.java that allows attackers with permission to configure jobs to read arbitrary files from the Jenkins master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-03-26/#SECURITY-545
CVE ID: CVE-2018-1000149 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-16T17:58:30.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that disables host key verification by default. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-03-26/#SECURITY-630
CVE ID: CVE-2018-1000150 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-16T18:34:55.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#authContext that allows attackers with local file system access to obtain a list of authorities for logged in users. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-03-26/#SECURITY-736
CVE ID: CVE-2018-1000151 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-16T23:35:56.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-03-26/#SECURITY-504
CVE ID: CVE-2018-1000152 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-16T16:18:07.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTempl
.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection"). Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-03-26/#SECURITY-745
CVE ID: CVE-2018-1000153 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-16T23:21:33.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTe
hot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection"). Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-03-26/#SECURITY-745
CVE ID: CVE-2018-1000154 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-16T18:33:29.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerability in the subject of emails which are not html quoted in certain cases. This can result in the embedding and execution of java script code on users browser. This attack appear to be exploitable via the victim openning a ticket. This vulnerability appears to have been fixed in 2.3.1, 2.2.2 and 2.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/z
n fixed in 2.3.1, 2.2.2 and 2.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zammad/zammad/issues/1869 - https://zammad.com/news/release-2-4 - https://zammad.com/news/security-advisory-zaa-2018-01
CVE ID: CVE-2018-1000155 State: PUBLISHED Published: 2018-05-24T13:00:00 Last Updated: 2024-08-05T12:33:49.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenFlow version 1.0 onwards contains a Denial of Service and Improper authorization vulnerability in OpenFlow handshake: The DPID (DataPath IDentifier) in the features_reply message are inherently trusted by the controller. that can result in Denial of Service, Unauthorized Access, Network Instability. This attack appear to be exploitable via Network connectivity: the attacker must first establish a transport connection with the OpenFlow controller and then initiate the OpenFlow handshake. Additional Analyst Notes: - CVE P
port connection with the OpenFlow controller and then initiate the OpenFlow handshake. Additional Analyst Notes: - CVE Program Container: References: - http://users.sec.t-labs.tu-berlin.de/~hashkash/openflow/BrianOnosSecurityRequest.pdf
CVE ID: CVE-2018-1000156 State: PUBLISHED Published: 2018-04-06T13:00:00.000Z Last Updated: 2025-04-14T19:36:21.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time. Additional Analyst Notes: - CVE Program Container: References: - https://savannah.gnu.org/bugs/index.php?53566 - https://lists.d
al Analyst Notes: - CVE Program Container: References: - https://savannah.gnu.org/bugs/index.php?53566 - https://lists.debian.org/debian-lts-announce/2018/04/msg00013.html - https://usn.ubuntu.com/3624-2/ - https://usn.ubuntu.com/3624-1/ - http://rachelbythebay.com/w/2018/04/05/bangpatch/ - https://access.redhat.com/errata/RHSA-2018:2091 - https://access.redhat.com/errata/RHSA-2018:2094 - https://access.redhat.com/errata/RHSA-2018:2093 - https://access.redhat.com/errata/RHSA-2018:1200 - https://access.redhat.com/errata/RHSA-2018:2095 - https://access.redhat.com/errata/RHSA-2018:1199 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=894667#19 - https://access.redhat.com/errata/RHSA-2018:209
2018:1199 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=894667#19 - https://access.redhat.com/errata/RHSA-2018:2092 - https://access.redhat.com/errata/RHSA-2018:2097 - https://access.redhat.com/errata/RHSA-2018:2096 - https://security.gentoo.org/glsa/201904-17 - https://seclists.org/bugtraq/2019/Jul/54 - https://seclists.org/bugtraq/2019/Aug/29 - http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html - https://web.archive.org/web/20180405231329/https://twitter.com/kurtseifried/status/982028968877436928
CVE ID: CVE-2018-1000157 State: REJECTED Published: 2018-04-07T07:00:00Z Last Updated: 2024-09-17T03:07:18.469Z Description: No description available.
CVE ID: CVE-2018-1000158 State: PUBLISHED Published: 2018-04-18T19:00:00 Last Updated: 2024-08-05T12:33:49.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line "$url = $config['admin_url'] . '/login.php?recoverme=' . $code;" that can result in Administrator Password Reset Poisoning, specifically a reset URL pointing at an attacker controlled server can be created by using a host header attack. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/11762
CVE ID: CVE-2018-1000159 State: PUBLISHED Published: 2018-04-18T19:00:00 Last Updated: 2024-08-05T12:33:49.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ct_check_cbc_mac_and_pad(); line "end_pos = data_len - 1 - mac.digest_size" that can result in an attacker manipulating the TLS ciphertext which will not be detected by receiving tlslite-ng. This attack appears to be exploitable via man in the middle on a network connection. This vulnerability appears t
te-ng. This attack appears to be exploitable via man in the middle on a network connection. This vulnerability appears to have been fixed after commit 3674815d1b0f7484454995e2737a352e0a6a93d8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tomato42/tlslite-ng/pull/234
CVE ID: CVE-2018-1000160 State: PUBLISHED Published: 2018-04-18T19:00:00 Last Updated: 2024-08-05T12:33:49.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in isXss() function in lib/rules/xss.js that can result in dangerous XSS strings being validated as safe. This attack appears to be exploitable via A number of XSS strings(26) detailed in the GitHub issue #16. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RisingStack/protect/blob/60b0c91e86686d34e5202419ce9ae7e8dc08edcd/lib/rules/xss.js#L4-L13 - http://embed.plnkr.co/xHbhB29JWWyMUMeHsLrm -
ct/blob/60b0c91e86686d34e5202419ce9ae7e8dc08edcd/lib/rules/xss.js#L4-L13 - http://embed.plnkr.co/xHbhB29JWWyMUMeHsLrm - https://github.com/RisingStack/protect/issues/16
CVE ID: CVE-2018-1000161 State: PUBLISHED Published: 2018-04-18T19:00:00 Last Updated: 2024-08-05T12:33:49.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: nmap version 6.49BETA6 through 7.60, up to and including SVN revision 37147 contains a Directory Traversal vulnerability in NSE script http-fetch that can result in file overwrite as the user is running it. This attack appears to be exploitable via a victim that runs NSE script http-fetch against a malicious web site. This vulnerability appears to have been fixed in 7.7. Additional Analyst Notes: - CVE Program Container: References: - https://nmap.org/changelog.html
CVE ID: CVE-2018-1000162 State: PUBLISHED Published: 2018-04-18T19:00:00 Last Updated: 2024-08-05T12:33:49.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST boundaries. This vulnerability appears to have been fixed in 1.7.0 and later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Roave/SecurityAdvisories/issues/44#issuecomment-368594409 - https://g
rogram Container: References: - https://github.com/Roave/SecurityAdvisories/issues/44#issuecomment-368594409 - https://github.com/erusev/parsedown/pull/495
CVE ID: CVE-2018-1000163 State: PUBLISHED Published: 2018-04-18T19:00:00 Last Updated: 2024-08-05T12:33:49.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: Floodlight version 1.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in the web console that can result in javascript injections into the web page. This attack appears to be exploitable via the victim browsing the web console. Additional Analyst Notes: - CVE Program Container: References: - https://xiaofen9.github.io/blog/floodlight-rce/
CVE ID: CVE-2018-1000164 State: PUBLISHED Published: 2018-04-18T19:00:00 Last Updated: 2024-08-05T12:33:49.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0. Additional Analyst Notes: - CVE Program Container: References: - https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunicorn-19.4.5 - https://lists.debian.org/debian-lts-announce/2018/04/msg00022.html -
18/04/02/http-header-splitting-in-gunicorn-19.4.5 - https://lists.debian.org/debian-lts-announce/2018/04/msg00022.html - https://github.com/benoitc/gunicorn/issues/1227 - https://www.debian.org/security/2018/dsa-4186 - https://usn.ubuntu.com/4022-1/
CVE ID: CVE-2018-1000165 State: PUBLISHED Published: 2018-04-18T19:00:00 Last Updated: 2024-08-05T12:33:49.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lightSAML/lightSAML/commit/47cef07bb09779df15620799f3763d1b8d32307a - https://github.com/lightSAML/lightSAML/releases/tag/1.3.5
CVE ID: CVE-2018-1000166 State: REJECTED Published: 2018-05-01T12:00:00 Last Updated: 2018-05-01T11:57:01 Description: No description available.
CVE ID: CVE-2018-1000167 State: PUBLISHED Published: 2018-04-18T19:00:00 Last Updated: 2024-08-05T12:33:49.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the following files: config.py:136, config.py:142, sources.py:99 and sources.py:131. The "list-sources"-command is affected by this bug. that can result in Remote Code Execution(even as root if suricata-update is called by root). This attack appears to be exploitable via a specially crafted yaml-file at https://www.openinfosecfoundation.org/rules/index.yaml. This vulnerability appears to have
pecially crafted yaml-file at https://www.openinfosecfoundation.org/rules/index.yaml. This vulnerability appears to have been fixed in 1.0.0b1. Additional Analyst Notes: - CVE Program Container: References: - https://tech.feedyourhead.at/content/remote-code-execution-in-suricata-update - https://redmine.openinfosecfoundation.org/issues/2359
CVE ID: CVE-2018-1000168 State: PUBLISHED Published: 2018-05-08T15:00:00.000Z Last Updated: 2025-06-09T15:47:51.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2019:0367 - https://nodejs.org/en/blog/vulnerability/june-2018-security-relea
s: - https://access.redhat.com/errata/RHSA-2019:0367 - https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ - http://www.securityfocus.com/bid/103952 - https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - https://access.redhat.com/errata/RHSA-2019:0366 - https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html
CVE ID: CVE-2018-1000169 State: PUBLISHED Published: 2018-04-13T21:00:00 Last Updated: 2024-08-05T12:33:49.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptionHandler.java that allows unauthorized attackers to confirm the existence of agents or views with an attacker-specified name by sending a CLI command to Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-04-11/#SECURITY-754 - https://access.redhat.com/errata/RHBA-2018:1816
CVE ID: CVE-2018-1000170 State: PUBLISHED Published: 2018-04-13T21:00:00 Last Updated: 2024-08-05T12:33:49.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in confirmationList.jelly and stopButton.jelly that allows attackers with Job/Configure and/or Job/Create permission to create an item name containing JavaScript that would be executed in another user's browser when that other user performs some UI actions. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-04-11/#SECURITY-759
CVE ID: CVE-2018-1000171 State: REJECTED Published: 2018-04-13T20:00:00Z Last Updated: 2024-09-16T22:19:38.123Z Description: No description available.