deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-13181
Published: 2019-12-16
Description: A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1236
References: http://packetstormsecurity.com/files/155673/Serv-U-FTP-Server-15.1.7-CSV-Injection.html; http://seclists.org/fulldisclosure/2019/Dec/33; https://www.themissinglink.com.au/security-advisories-cve-2019-13181
CVE: CVE-2019-13182
Published: 2019-12-16
Description: A stored cross-site scripting (XSS) vulnerability exists in the web UI of SolarWinds Serv-U FTP Server 15.1.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155672/Serv-U-FTP-Server-15.1.7-Persistent-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2019/Dec/32; https://www.themissinglink.com.au/security-advisories-cve-2019-13182
CVE: CVE-2019-16778
Published: 2019-12-16
Description: In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and num_segments fields are truncated from int64 to int32 and can produce negative numbers, resulting in accessing out of bounds heap memory. This is unlikely to be exploitable and was detected and fixed internally in TensorFlow 1.15 and 2.0.
CVSS Score: 2.6 (LOW)
CWE: CWE-122, CWE-681
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2019-002.md; https://github.com/tensorflow/tensorflow/commit/db4f9717c41bccc3ce10099ab61996b246099892; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-844w-j86r-4x2j
CVE: CVE-2019-18191
Published: 2019-12-16
Description: A privilege escalation vulnerability in the Trend Micro Deep Security as a Service Quick Setup cloud formation template could allow an authenticated entity with certain unrestricted AWS execution privileges to escalate to full privileges within the target AWS account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-459
References: https://success.trendmicro.com/solution/000157758; https://success.trendmicro.com/solution/000157758
CVE: CVE-2019-19818
Published: 2019-12-16
Description: The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0xa08a Out-of-Bounds Read via crafted Unicode content.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-12-12-multiple-nitro-pdf-vulnerability.md; https://nafiez.github.io/security/vulnerability/remote/2019/12/12/multiple-nitro-pdf-vulnerability.html; https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-12-12-multiple-nitro-pdf-vulnerability.md
CVE: CVE-2018-11751
Published: 2019-12-16
Description: Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-295
References: https://puppet.com/security/cve/CVE-2018-11751; https://puppet.com/security/cve/CVE-2018-11751
CVE: CVE-2019-12413
Published: 2019-12-16
Description: In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted complex query.
CVSS Score: 5.3 (MEDIUM)
References: https://lists.apache.org/thread.html/85ab04f8c52df8c353ecfa0ecd2ff27fc07fb8ab7566a754349806be%40%3Cdev.superset.apache.org%3E; https://lists.apache.org/thread.html/85ab04f8c52df8c353ecfa0ecd2ff27fc07fb8ab7566a754349806be%40%3Cdev.superset.apache.org%3E
CVE: CVE-2019-12414
Published: 2019-12-16
Description: In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://lists.apache.org/thread.html/396034aabe08dd349ff44eb062c718aadcf1b4e86f6372c7d5e988c0%40%3Cdev.superset.apache.org%3E; https://lists.apache.org/thread.html/396034aabe08dd349ff44eb062c718aadcf1b4e86f6372c7d5e988c0%40%3Cdev.superset.apache.org%3E
CVE: CVE-2019-5259
Published: 2019-12-16
Description: There is an information leakage vulnerability on some Huawei products(AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;AR2200;AR2200-S;AR3200;AR3600). An attacker with low permissions can view some high-privilege information by running specific commands.Successful exploit could cause an information disclosure condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-vrp-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-vrp-en
CVE: CVE-2019-19826
Published: 2019-12-16
Description: The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_fields.inc, as demonstrated by PHP object injection, involving a field_names object and an Archive_Tar object, for file deletion. Code execution might also be possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.drupal.org/project/views_dynamic_fields/issues/3056600; https://www.drupal.org/project/views_dynamic_fields/issues/3056600
CVE: CVE-2017-18107
Published: 2019-12-17
Description: Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups via a Cross-site request forgery (CSRF) vulnerability. Please be aware that the Demo application is not enabled by default.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://jira.atlassian.com/browse/CWD-5091; https://jira.atlassian.com/browse/CWD-5091
CVE: CVE-2019-15011
Published: 2019-12-17
Description: The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclosed application link information to non-admin users via a missing permissions check.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: https://ecosystem.atlassian.net/browse/APL-1386; https://ecosystem.atlassian.net/browse/APL-1386
CVE: CVE-2019-19830
Published: 2019-12-17
Description: _core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.
CVSS Score: 6.5 (MEDIUM)
References: https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-sortie-de-SPIP-3-2-7-SPIP-3-1-12.html; https://git.spip.net/SPIP/spip/commit/8eb11ba132b92696eb34d606d71aa8edf40e0f69; https://usn.ubuntu.com/4536-1/
CVE: CVE-2019-19813
Published: 2019-12-17
Description: In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in __mutex_lock in kernel/locking/mutex.c. This is related to mutex_can_spin_on_owner in kernel/locking/mutex.c, __btrfs_qgroup_free_meta in fs/btrfs/qgroup.c, and btrfs_insert_delayed_items in fs/btrfs/delayed-inode.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19813; https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html; https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
CVE: CVE-2019-19814
Published: 2019-12-17
Description: In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bounds write access because an array is bounded by the number of dirty types (8) but the array index can exceed this.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19814; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19814
CVE: CVE-2019-19816
Published: 2019-12-17
Description: In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19816; https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html; https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
CVE: CVE-2019-19815
Published: 2019-12-17
Description: In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause a NULL pointer dereference in f2fs_recover_fsync_data in fs/f2fs/recovery.c. This is related to F2FS_P_SB in fs/f2fs/f2fs.h.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19815; https://github.com/torvalds/linux/commit/4969c06a0d83c9c3dc50b8efcdc8eeedfce896f6#diff-41a7fa4590d2af87e82101f2b4dadb56; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2014-8178
Published: 2019-12-17
Description: Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html; http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html; https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12
CVE: CVE-2019-18824
Published: 2019-12-17
Description: Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The ClickShare Button does not verify the integrity of the mutable content on the UBIFS partition before being used.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-345
References: https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/; https://www.barco.com/en/clickshare/firmware-update; https://www.barco.com/en/clickshare/support/software/R33050069?majorVersion=01&minorVersion=10&patchVersion=00&buildVersion=013
CVE: CVE-2019-18825
Published: 2019-12-17
Description: Barco ClickShare Huddle CS-100 devices before 1.9.0 and CSE-200 devices before 1.9.0 have incorrect Credentials Management. The ClickShare Base Unit implements encryption at rest using encryption keys which are shared across all ClickShare Base Units of models CS-100 & CSE-200.
CVSS Score: 7.5 (HIGH)
References: https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/; https://www.barco.com/en/clickshare/firmware-update; https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/
CVE: CVE-2019-18829
Published: 2019-12-17
Description: Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The Barco signed 'Clickshare_For_Windows.exe' binary on the ClickShare Button (R9861500D01) loads a number of DLL files dynamically without verifying their integrity.
CVSS Score: 7.8 (HIGH)
CWE: CWE-345
References: https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/; https://www.barco.com/en/clickshare/firmware-update; https://www.barco.com/en/clickshare/support/software/R33050069?majorVersion=01&minorVersion=10&patchVersion=00&buildVersion=013
CVE: CVE-2019-18832
Published: 2019-12-17
Description: Barco ClickShare Button R9861500D01 devices before 1.9.0 have incorrect Credentials Management. The ClickShare Button implements encryption at rest which uses a one-time programmable (OTP) AES encryption key. This key is shared across all ClickShare Buttons of model R9861500D01.
CVSS Score: 8.1 (HIGH)
CWE: CWE-327
References: https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/; https://www.barco.com/en/clickshare/firmware-update; https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/
CVE: CVE-2019-18833
Published: 2019-12-17
Description: Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2).. The encryption key of the media content which is shared between a ClickShare Button and a ClickShare Base Unit is randomly generated for each new session and communicated over a TLS connection. An attacker who is able to perform a Man-in-the-Middle attack between the TLS connection, is able to obtain the encryption key.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-311
References: https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/; https://www.barco.com/en/clickshare/firmware-update; https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/
CVE: CVE-2019-19264
Published: 2019-12-17
Description: In Simplifile RecordFusion through 2019-11-25, the logs and hist parameters allow remote attackers to access local files via a logger/logs?/../ or logger/hist?/../ URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.securenetworkinc.com/news/2019/11/26/recordfusion-local-file-inclusion-vulnerability-cve-2019-19264; https://www.securenetworkinc.com/news/2019/11/26/recordfusion-local-file-inclusion-vulnerability-cve-2019-19264
CVE: CVE-2019-19712
Published: 2019-12-17
Description: Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://contao.org/en/news.html; https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html; https://contao.org/en/news.html
CVE: CVE-2019-16549
Published: 2019-12-17
Description: Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1681; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16550
Published: 2019-12-17
Description: A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1681; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16551
Published: 2019-12-17
Description: A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1527; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16552
Published: 2019-12-17
Description: A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins master.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1527; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16553
Published: 2019-12-17
Description: A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1651; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16554
Published: 2019-12-17
Description: A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1651; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16555
Published: 2019-12-17
Description: A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1651; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16556
Published: 2019-12-17
Description: Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1636; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16557
Published: 2019-12-17
Description: Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1598; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16558
Published: 2019-12-17
Description: Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM.
CVSS Score: 8.2 (HIGH)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1580; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16559
Published: 2019-12-17
Description: A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16560
Published: 2019-12-17
Description: A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16561
Published: 2019-12-17
Description: Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM.
CVSS Score: 7.1 (HIGH)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1581; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16562
Published: 2019-12-17
Description: Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS vulnerability exploitable by users able to change build descriptions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1591; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16563
Published: 2019-12-17
Description: Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to change these properties.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1592; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16564
Published: 2019-12-17
Description: Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to affects view content such as job display name or pipeline stage names.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1593; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16565
Published: 2019-12-17
Description: A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1605%20%281%29; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16566
Published: 2019-12-17
Description: A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1605%20%281%29; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16567
Published: 2019-12-17
Description: A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1605%20%282%29; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16568
Published: 2019-12-17
Description: Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as individual jobs' configurations.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1521; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16569
Published: 2019-12-17
Description: A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified web server using attacker-specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1603; http://www.openwall.com/lists/oss-security/2019/12/17/1