deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-4436
Published: 2019-04-03
Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209342; https://support.apple.com/kb/HT209343
CVE: CVE-2018-4437
Published: 2019-04-03
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209342; https://support.apple.com/kb/HT209343
CVE: CVE-2018-4438
Published: 2019-04-03
Description: A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209342; https://support.apple.com/kb/HT209343
CVE: CVE-2018-4439
Published: 2019-04-03
Description: A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209344; https://support.apple.com/kb/HT209345
CVE: CVE-2018-4440
Published: 2019-04-03
Description: A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209344; https://support.apple.com/kb/HT209345
CVE: CVE-2018-4441
Published: 2019-04-03
Description: A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209342; https://support.apple.com/kb/HT209343
CVE: CVE-2018-4442
Published: 2019-04-03
Description: A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209342; https://support.apple.com/kb/HT209343
CVE: CVE-2018-4443
Published: 2019-04-03
Description: A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209342; https://support.apple.com/kb/HT209343
CVE: CVE-2018-4445
Published: 2019-04-03
Description: "Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209344; https://support.apple.com/kb/HT209340
CVE: CVE-2018-4446
Published: 2019-04-03
Description: This issue was addressed with improved entitlements. This issue affected versions prior to iOS 12.1.1.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209340
CVE: CVE-2018-4447
Published: 2019-04-03
Description: A memory corruption issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209341; https://support.apple.com/kb/HT209342
CVE: CVE-2018-4449
Published: 2019-04-03
Description: A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/kb/HT209341; https://support.apple.com/kb/HT209341
CVE: CVE-2018-4450
Published: 2019-04-03
Description: A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/kb/HT209341; https://support.apple.com/kb/HT209341
CVE: CVE-2018-4456
Published: 2019-04-03
Description: A memory corruption issue was addressed with improved input validation. This issue affected versions prior to macOS High Sierra 10.13.6, macOS Mojave 10.14.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2019/May/20; https://seclists.org/bugtraq/2019/May/27; https://support.apple.com/kb/HT208937
CVE: CVE-2018-4460
Published: 2019-04-03
Description: A denial of service issue was addressed by removing the vulnerable code. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209341; https://support.apple.com/kb/HT209342
CVE: CVE-2018-4461
Published: 2019-04-03
Description: A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209341; https://support.apple.com/kb/HT209342
CVE: CVE-2018-4462
Published: 2019-04-03
Description: A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14.2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/kb/HT209341; https://support.apple.com/kb/HT209341
CVE: CVE-2018-4463
Published: 2019-04-03
Description: A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/kb/HT209341; https://support.apple.com/kb/HT209341
CVE: CVE-2018-4464
Published: 2019-04-03
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209342; https://support.apple.com/kb/HT209343
CVE: CVE-2018-4465
Published: 2019-04-03
Description: A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/kb/HT209340; https://support.apple.com/kb/HT209341; https://support.apple.com/kb/HT209340
CVE: CVE-2018-4470
Published: 2019-04-03
Description: A privacy issue in the handling of Open Directory records was addressed with improved indexing. This issue affected versions prior to macOS High Sierra 10.13.6.
CVSS Score: 3.3 (LOW)
References: https://support.apple.com/kb/HT208937; https://support.apple.com/kb/HT208937
CVE: CVE-2019-10240
Published: 2019-04-03
Description: Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-494, CWE-829, CWE-319
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=546053; https://bugs.eclipse.org/bugs/show_bug.cgi?id=546053
CVE: CVE-2019-10723
Published: 2019-04-03
Description: An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocation because nInitialSize is not validated.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://sourceforge.net/p/podofo/tickets/46/; https://sourceforge.net/p/podofo/tickets/46/
CVE: CVE-2015-5606
Published: 2019-04-03
Description: Vordel XML Gateway (acquired by Axway) version 7.2.2 could allow remote attackers to cause a denial of service via a specially crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.excellium-services.com/cert-xlm-advisory/cve-2015-5606/; https://www.excellium-services.com/cert-xlm-advisory/cve-2015-5606/
CVE: CVE-2015-5463
Published: 2019-04-03
Description: AxiomSL's Axiom java applet module (used for editing uploaded Excel files and associated Java RMI services) 9.5.3 and earlier allows remote attackers to (1) access data of other basic users through arbitrary SQL commands, (2) perform a horizontal and vertical privilege escalation, (3) cause a Denial of Service on global application, or (4) write/read/delete arbitrary files on server hosting the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285
References: https://www.excellium-services.com/cert-xlm-advisory/cve-2015-5463/; https://www.excellium-services.com/cert-xlm-advisory/cve-2015-5463/
CVE: CVE-2015-5384
Published: 2019-04-03
Description: AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier is vulnerable to a Session Fixation attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: https://www.excellium-services.com/cert-xlm-advisory/cve-2015-5384/; https://www.excellium-services.com/cert-xlm-advisory/cve-2015-5384/
CVE: CVE-2015-5462
Published: 2019-04-03
Description: AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier allows remote attackers to inject HTML into the scoping dashboard features.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: https://www.excellium-services.com/cert-xlm-advisory/cve-2015-5462/; https://www.excellium-services.com/cert-xlm-advisory/cve-2015-5462/
CVE: CVE-2019-10842
Published: 2019-04-04
Description: Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticated attacker can craft the ___cfduid cookie value with base64 arbitrary code to be executed via eval(), which can be leveraged to execute arbitrary code on the target system. Note that there are three underscore characters in the cookie name. This is unrelated to the __cfduid cookie that is legitimately used by Cloudflare.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://dgb.github.io/2019/04/05/bootstrap-sass-backdoor.html; https://github.com/twbs/bootstrap-sass/issues/1195; https://snyk.io/blog/malicious-remote-code-execution-backdoor-discovered-in-the-popular-bootstrap-sass-ruby-gem/
CVE: CVE-2019-10844
Published: 2019-04-04
Description: nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) through v1.0.14 relies on the HOME environment variable, which might be untrusted.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/sony/nnabla/issues/209; https://github.com/sony/nnabla/issues/209
CVE: CVE-2014-3603
Published: 2019-04-04
Description: The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-297
References: http://secunia.com/advisories/60816; http://shibboleth.net/community/advisories/secadv_20140813.txt; https://bugzilla.redhat.com/show_bug.cgi?id=1131823
CVE: CVE-2019-5022
Published: 2019-04-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: this candidate is not about any specific product, protocol, or design, that falls into the scope of the assigning CNA. Notes: None
CVE: CVE-2018-10242
Published: 2019-04-04
Description: Suricata version 4.0.4 incorrectly handles the parsing of the SSH banner. A malformed SSH banner can cause the parsing code to read beyond the allocated data because SSHParseBanner in app-layer-ssh.c lacks a length check.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://lists.debian.org/debian-lts-announce/2019/04/msg00010.html; https://suricata-ids.org/2018/07/18/suricata-4-0-5-available/; https://lists.debian.org/debian-lts-announce/2019/04/msg00010.html
CVE: CVE-2018-11830
Published: 2019-04-04
Description: Improper input validation in QCPE create function may lead to integer overflow in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9206, MDM9607, MDM9650, MDM9655, MSM8996AU, SD 410/12, SD 820A
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11958
Published: 2019-04-04
Description: Insufficient protection of keys in keypad can lead HLOS to gain access to confidential keypad input data in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9206, MDM9607, MDM9650, MDM9655, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016
CVSS Score: 5.5 (MEDIUM)
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11966
Published: 2019-04-04
Description: Undefined behavior in UE while processing unknown IEI in OTA message in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SM7150, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11970
Published: 2019-04-04
Description: TZ App dynamic allocations not protected from XBL loader in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 410/12, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660, SXR1130
CVSS Score: 7.8 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11971
Published: 2019-04-04
Description: Interrupt exit code flow may undermine access control policy set forth by secure world can lead to potential secure asset leakage in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 410/12, SD 615/16/SD 415, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660, SXR1130
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-13918
Published: 2019-04-04
Description: kernel could return a received message length higher than expected, which leads to buffer overflow in a subsequent operation and stops normal operation in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 675, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM439, SDX24, SM7150
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-19981
Published: 2019-04-04
Description: Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service. An attacker can use these credentials to create authenticated and/or authorized requests. Note that the attacker must have "root" privilege access to the Android filesystem in order to exploit this vulnerability (i.e. the device has been compromised, such as disabling or bypassing Android's fundamental security mechanisms).
CVSS Score: 7.2 (HIGH)
CWE: CWE-312
References: https://aws-amplify.github.io/aws-sdk-android/docs/reference/com/amazonaws/auth/CognitoCachingCredentialsProvider.html; https://raw.githubusercontent.com/lorenzodifuccia/cloudflare/master/Images/vulns/aws/aws_sdk_sp_01.png; https://raw.githubusercontent.com/lorenzodifuccia/cloudflare/master/Images/vulns/aws/aws_sdk_sp_02.png
CVE: CVE-2018-10243
Published: 2019-04-04
Description: htp_parse_authorization_digest in htp_parsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://lists.debian.org/debian-lts-announce/2019/04/msg00010.html; https://suricata-ids.org/2018/07/18/suricata-4-0-5-available/; https://lists.debian.org/debian-lts-announce/2019/04/msg00010.html
CVE: CVE-2018-10244
Published: 2019-04-04
Description: Suricata version 4.0.4 incorrectly handles the parsing of an EtherNet/IP PDU. A malformed PDU can cause the parsing code to read beyond the allocated data because DecodeENIPPDU in app-layer-enip-commmon.c has an integer overflow during a length check.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://suricata-ids.org/2018/07/18/suricata-4-0-5-available/; https://suricata-ids.org/2018/07/18/suricata-4-0-5-available/
CVE: CVE-2018-20222
Published: 2019-04-04
Description: XXE issue in Airsonic before 10.1.2 during parse.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/airsonic/airsonic/blob/master/CHANGELOG.md; https://github.com/airsonic/airsonic/releases/tag/v10.2.1; https://github.com/airsonic/airsonic/blob/master/CHANGELOG.md
CVE: CVE-2018-20449
Published: 2019-04-04
Description: The hidma_chan_stats function in drivers/dma/qcom/hidma_dbg.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by reading "callback=" lines in a debugfs file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://elixir.bootlin.com/linux/v4.14.90/source/drivers/dma/qcom/hidma_dbg.c#L92; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.mail-archive.com/debian-security-tracker%40lists.debian.org/msg03808.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-04-04
Description: Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-311
References: http://www.openwall.com/lists/oss-security/2019/04/12/2; http://www.securityfocus.com/bid/107790; https://jenkins.io/security/advisory/2019-04-03/#SECURITY-829
CVE: CVE-2[PII_REDACTED]
Published: 2019-04-04
Description: Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-311
References: http://www.openwall.com/lists/oss-security/2019/04/12/2; http://www.securityfocus.com/bid/107790; https://jenkins.io/security/advisory/2019-04-03/#SECURITY-831
CVE: CVE-2[PII_REDACTED]
Published: 2019-04-04
Description: Jenkins HockeyApp Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-311
References: http://www.openwall.com/lists/oss-security/2019/04/12/2; http://www.securityfocus.com/bid/107790; https://jenkins.io/security/advisory/2019-04-03/#SECURITY-839
CVE: CVE-2[PII_REDACTED]
Published: 2019-04-04
Description: Jenkins Jira Issue Updater Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-311
References: http://www.openwall.com/lists/oss-security/2019/04/12/2; http://www.securityfocus.com/bid/107790; https://jenkins.io/security/advisory/2019-04-03/#SECURITY-837
CVE: CVE-2[PII_REDACTED]
Published: 2019-04-04
Description: Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-311
References: http://www.openwall.com/lists/oss-security/2019/04/12/2; http://www.securityfocus.com/bid/107790; https://jenkins.io/security/advisory/2019-04-03/#SECURITY-954
CVE: CVE-2[PII_REDACTED]
Published: 2019-04-04
Description: Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-311
References: http://www.openwall.com/lists/oss-security/2019/04/12/2; http://www.securityfocus.com/bid/107790; https://jenkins.io/security/advisory/2019-04-03/#SECURITY-956
CVE: CVE-2[PII_REDACTED]
Published: 2019-04-04
Description: Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-311
References: http://www.openwall.com/lists/oss-security/2019/04/12/2; http://www.securityfocus.com/bid/107790; https://jenkins.io/security/advisory/2019-04-03/#SECURITY-965
CVE: CVE-2[PII_REDACTED]
Published: 2019-04-04
Description: A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers to initiate a connection to an attacker-specified server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/04/12/2; http://www.securityfocus.com/bid/107790; https://jenkins.io/security/advisory/2019-04-03/#SECURITY-974
CVE: CVE-2[PII_REDACTED]
Published: 2019-04-04
Description: A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2019/04/12/2; http://www.securityfocus.com/bid/107790; https://jenkins.io/security/advisory/2019-04-03/#SECURITY-974