Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
- https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html - http://www.openwall.com/lists/oss-security/2018/06/26/3 - https://usn.ubuntu.com/3754-1/ - https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html - https://access.redhat.com/errata/RHSA-2018:2948 - https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 - https://usn.ubuntu.com/3696-2/ - https://usn.ubuntu.com/3752-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html
CVE ID: CVE-2018-1000205 State: PUBLISHED Published: 2018-06-26T16:00:00Z Last Updated: 2024-09-17T04:09:48.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result in Bypass verified boot. This attack appear to be exploitable via Specially crafted FIT image and special device memory functionality. Additional Analyst Notes: - CVE Program Container: References: - https://lists.denx.de/pipermail/u-boot/2018-June/330454.html - https://lists.denx.de/pipermail/u-boot/2018-June/330898.html
CVE ID: CVE-2018-1000206 State: PUBLISHED Published: 2018-07-13T18:00:00Z Last Updated: 2024-09-16T17:32:45.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flash component. This vulnerability appears to have been fixed in 6.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.geekboy.ninja/blog/exploiting-json-cross-site-request-forgery-csrf-using-flash/ - htt
ntainer: References: - https://www.geekboy.ninja/blog/exploiting-json-cross-site-request-forgery-csrf-using-flash/ - https://www.jfrog.com/jira/secure/ReleaseNote.jspa?projectId=10070&version=19581 - https://www.jfrog.com/jira/browse/RTFACT-17004
CVE ID: CVE-2018-1000207 State: PUBLISHED Published: 2018-07-13T18:00:00 Last Updated: 2024-08-05T12:40:46.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68. Additional Analyst Notes: - CVE Program Container: References: - https://rudnkh.me/posts/critical-vulnerability-in-modx-revolution-2-6-4 - https://github.com
am Container: References: - https://rudnkh.me/posts/critical-vulnerability-in-modx-revolution-2-6-4 - https://github.com/modxcms/revolution/pull/13979 - https://github.com/a2u/CVE-2018-1000207 - https://github.com/modxcms/revolution/commit/06bc94257408f6a575de20ddb955aca505ef6e68
CVE ID: CVE-2018-1000208 State: PUBLISHED Published: 2018-07-13T18:00:00Z Last Updated: 2024-09-16T18:17:58.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: MODX Revolution version <=2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can result in remove files. This attack appear to be exploitable via web request via security/login processor. This vulnerability appears to have been fixed in pull 13980. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/modxcms/revolution/pull/13980
CVE ID: CVE-2018-1000209 State: PUBLISHED Published: 2018-07-13T18:00:00Z Last Updated: 2024-09-17T00:16:38.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sensu, Inc. Sensu Core version Before version 1.4.2-3 contains a Insecure Permissions vulnerability in Sensu Core on Windows platforms that can result in Unprivileged users may execute code in context of Sensu service account. This attack appear to be exploitable via Unprivileged user may place an arbitrary DLL in the c:\opt\sensu\embedded\bin directory in order to exploit standard Windows DLL load order behavior. This vulnerability appears to have been fixed in 1.4.2-3 and later. Additional Analyst Notes: - CVE Program Co
behavior. This vulnerability appears to have been fixed in 1.4.2-3 and later. Additional Analyst Notes: - CVE Program Container: References: - https://docs.sensu.io/sensu-core/1.4/changelog/#core-v1-4-2
CVE ID: CVE-2018-1000210 State: PUBLISHED Published: 2018-07-13T18:00:00Z Last Updated: 2024-09-16T19:46:15.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deserialize user-controlled types in the line "currentType = Type.GetType(nodeEvent.Tag.Substring(1), throwOnError: false);" and blindly instantiates them. that can result in Code execution in the context of the running process. This attack appear to be exploitable via Victim must parse a specially-crafted YAML file. This vulnerability appears to have been fixed in 5.0.0.
exploitable via Victim must parse a specially-crafted YAML file. This vulnerability appears to have been fixed in 5.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aaubry/YamlDotNet#version-500 - https://github.com/aaubry/YamlDotNet/blob/f96b7cc40a0498f8bafdeb49df3aa23aa2c60993/YamlDotNet/Serialization/NodeTypeResolvers/TypeNameInTagNodeTypeResolver.cs#L35
CVE ID: CVE-2018-1000211 State: PUBLISHED Published: 2018-07-13T18:00:00Z Last Updated: 2024-09-17T03:34:15.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/doorkeeper-gem/doorkeeper/pull/1119 - https://github.com/doorkeeper-gem/doorkeeper/issues/891
CVE ID: CVE-2018-1000212 State: REJECTED Published: 2018-08-20T20:00:00Z Last Updated: 2024-09-17T03:48:52.394Z Description: No description available.
CVE ID: CVE-2018-1000213 State: REJECTED Published: 2018-08-20T20:00:00Z Last Updated: 2024-09-17T00:31:08.264Z Description: No description available.
CVE ID: CVE-2018-1000214 State: REJECTED Published: 2018-08-20T20:00:00Z Last Updated: 2024-09-17T01:36:27.579Z Description: No description available.
CVE ID: CVE-2018-1000215 State: PUBLISHED Published: 2018-08-20T20:00:00Z Last Updated: 2024-09-16T20:52:02.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial of Service (DoS). This attack appear to be exploitable via If the attacker can force the data to be printed and the system is in low memory it can force a leak of memory. This vulnerability appears to have been fixed in 1.7.7. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DaveGamble/cJSON/issues/267
CVE ID: CVE-2018-1000216 State: PUBLISHED Published: 2018-08-20T20:00:00Z Last Updated: 2024-09-17T03:43:41.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash or RCE. This attack appear to be exploitable via Attacker must be able to force victim to print JSON data, depending on how cJSON library is used this could be either local or over a network. This vulnerability appears to have been fixed in 1.7.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DaveGamble/cJSON/issues/241
CVE ID: CVE-2018-1000217 State: PUBLISHED Published: 2018-08-20T20:00:00Z Last Updated: 2024-09-16T22:45:43.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible crash, corruption of data or even RCE. This attack appear to be exploitable via Depends on how application uses cJSON library. If application provides network interface then can be exploited over a network, otherwise just local.. This vulnerability appears to have been fixed in 1.7.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DaveGamble/cJSON/iss
fixed in 1.7.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DaveGamble/cJSON/issues/248
CVE ID: CVE-2018-1000218 State: PUBLISHED Published: 2018-08-20T20:00:00Z Last Updated: 2024-09-17T03:53:06.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'file' parameter in line #43 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack appear to be exploitable via The victim must visit on a specially crafted URL.. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openemr/openemr/issues/1781 - https://github.com/openemr/openemr/blob/1b495b0b3cd16daf1e
eferences: - https://github.com/openemr/openemr/issues/1781 - https://github.com/openemr/openemr/blob/1b495b0b3cd16daf1e5f085145d9e19dea479c7f/interface/fax/fax_view.php#L43
CVE ID: CVE-2018-1000219 State: PUBLISHED Published: 2018-08-20T20:00:00Z Last Updated: 2024-09-16T19:14:25.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'scan' parameter in line #41 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack appear to be exploitable via The victim must visit on a specially crafted URL.. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openemr/openemr/issues/1781 - https://github.com/openemr/openemr/blob/1b495b0b3cd16daf1e
eferences: - https://github.com/openemr/openemr/issues/1781 - https://github.com/openemr/openemr/blob/1b495b0b3cd16daf1e5f085145d9e19dea479c7f/interface/fax/fax_view.php#L41
CVE ID: CVE-2018-1000220 State: REJECTED Published: 2018-08-20T20:00:00Z Last Updated: 2024-09-17T02:42:25.422Z Description: No description available.
CVE ID: CVE-2018-1000221 State: PUBLISHED Published: 2018-08-20T20:00:00Z Last Updated: 2024-09-17T00:05:27.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in dequote() that can result in dequote() function returns 1-byte allocation if initial length is 0, leading to buffer overflow. This attack appear to be exploitable via specially crafted .pc file. This vulnerability appears to have been fixed in 1.5.3. Additional Analyst Notes: - CVE Program Container: References: - https://git.dereferenced.org/pkgconf/pkgconf/pulls/3
CVE ID: CVE-2018-1000222 State: PUBLISHED Published: 2018-08-20T20:00:00 Last Updated: 2024-08-05T12:40:46.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libgd/libgd/issues/447 - https://usn.ubuntu.com/3755-1/ - https://lists.debian.org/debian-lts-announce/201
://github.com/libgd/libgd/issues/447 - https://usn.ubuntu.com/3755-1/ - https://lists.debian.org/debian-lts-announce/2019/01/msg00028.html - https://security.gentoo.org/glsa/201903-18 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/
CVE ID: CVE-2018-1000223 State: PUBLISHED Published: 2018-08-20T20:00:00Z Last Updated: 2024-09-16T16:13:06.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: soundtouch version up to and including 2.0.0 contains a Buffer Overflow vulnerability in SoundStretch/WavFile.cpp:WavInFile::readHeaderBlock() that can result in arbitrary code execution. This attack appear to be exploitable via victim must open maliocius file in soundstretch utility. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/soundtouch/soundtouch/issues/6
CVE ID: CVE-2018-1000224 State: PUBLISHED Published: 2018-08-20T20:00:00Z Last Updated: 2024-09-17T02:37:16.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer overflow, missing padding initialization vulnerability in (De)Serialization functions (core/io/marshalls.cpp) that can result in DoS (packet of death), possible leak of uninitialized memory. This attack appear to be exploitable via A malformed packet is received over the network by a Godot application that uses built-in serialization (e.g. game server, or game client).
is received over the network by a Godot application that uses built-in serialization (e.g. game server, or game client). Could be triggered by multiplayer opponent. This vulnerability appears to have been fixed in 2.1.5, 3.0.6, master branch after commit feaf03421dda0213382b51aff07bd5a96b29487b. Additional Analyst Notes: - CVE Program Container: References: - https://godotengine.org/article/maintenance-release-godot-2-1-5 - https://github.com/godotengine/godot/issues/20558 - https://godotengine.org/article/maintenance-release-godot-3-0-6
CVE ID: CVE-2018-1000225 State: PUBLISHED Published: 2018-08-20T20:00:00 Last Updated: 2024-08-05T12:40:46.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via "network connectivity". Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cobbler/cobbler/i
PI (/cobbler_api). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cobbler/cobbler/issues/1917 - https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/
CVE ID: CVE-2018-1000226 State: PUBLISHED Published: 2018-08-20T20:00:00 Last Updated: 2024-08-05T12:40:46.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than C
aking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931. Additional Analyst Notes: - CVE Program Container: References: - https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/ - https://github.com/cobbler/cobbler/issues/1916
CVE ID: CVE-2018-1000300 State: PUBLISHED Published: 2018-05-24T13:00:00 Last Updated: 2024-08-05T12:40:46.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This vulnerability appears to have been fixed in curl < 7.54.1 and curl >= 7.60.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - https://www.orac
Container: References: - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://curl.haxx.se/docs/adv_2018-82c2.html - https://security.gentoo.org/glsa/201806-05 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://usn.ubuntu.com/3648-1/ - http://www.securityfocus.com/bid/104207 - http://www.securitytracker.com/id/1040933
CVE ID: CVE-2018-1000301 State: PUBLISHED Published: 2018-05-24T13:00:00 Last Updated: 2024-08-05T12:40:46.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104225 - https://lists.debian.org/debian-lts-announce/2018/05/msg00010.html - http://ww
http://www.securityfocus.com/bid/104225 - https://lists.debian.org/debian-lts-announce/2018/05/msg00010.html - http://www.securitytracker.com/id/1040931 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://access.redhat.com/errata/RHSA-2018:3558 - https://curl.haxx.se/docs/adv_2018-b138.html - https://access.redhat.com/errata/RHSA-2018:3157 - https://security.gentoo.org/glsa/201806-05 - https://www.debian.org/security/2018/dsa-4202 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://usn.ubuntu.com/3648-1/ - https://usn.ubuntu.com/3598-2/ - http
twork/security-advisory/cpuoct2018-4428296.html - https://usn.ubuntu.com/3648-1/ - https://usn.ubuntu.com/3598-2/ - https://access.redhat.com/errata/RHBA-2019:0327 - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://access.redhat.com/errata/RHSA-2020:0544 - https://access.redhat.com/errata/RHSA-2020:0594
CVE ID: CVE-2018-1000400 State: PUBLISHED Published: 2018-05-18T18:00:00 Last Updated: 2024-08-05T12:40:47.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via container execution. This vulnerability appears to have been fixed in 1.9. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kubernetes-incubator/cri-o/pull/1558/files - http://www.securityfocus.
ogram Container: References: - https://github.com/kubernetes-incubator/cri-o/pull/1558/files - http://www.securityfocus.com/bid/104262
CVE ID: CVE-2018-1000401 State: PUBLISHED Published: 2018-07-09T13:00:00 Last Updated: 2024-08-05T12:40:46.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins project Jenkins AWS CodePipeline Plugin version 0.36 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodePipelineSCM.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 0.37 and later. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-06-25/#SECURITY-967
CVE ID: CVE-2018-1000402 State: PUBLISHED Published: 2018-07-09T13:00:00 Last Updated: 2024-08-05T12:40:46.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a File and Directory Information Exposure vulnerability in AWSCodeDeployPublisher.java that can result in Disclosure of environment variables. This vulnerability appears to have been fixed in 1.20 and later. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-06-25/#SECURITY-825
CVE ID: CVE-2018-1000403 State: PUBLISHED Published: 2018-07-09T13:00:00 Last Updated: 2024-08-05T12:40:46.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodeDeployPublisher.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 1.20 and later. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-06-25/#SECURITY-833
CVE ID: CVE-2018-1000404 State: PUBLISHED Published: 2018-07-09T13:00:00 Last Updated: 2024-08-05T12:40:46.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins project Jenkins AWS CodeBuild Plugin version 0.26 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSClientFactory.java, CodeBuilder.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 0.27 and later. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-06-25/#SECURITY-834
CVE ID: CVE-2018-1000406 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:47.025Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that allows attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1
ner: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1074
CVE ID: CVE-2018-1000407 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1129