deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-14500
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2019
CVE: CVE-2019-14501
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2019
CVE: CVE-2019-14502
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2019
CVE: CVE-2019-14503
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2019
CVE: CVE-2019-14504
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2019
CVE: CVE-2019-14505
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2019
CVE: CVE-2019-14506
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2019
CVE: CVE-2019-14507
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2019
CVE: CVE-2019-14508
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2019
CVE: CVE-2020-10020
Published: 2020-03-07
Description: Rejected reason: Number assigned to issue that does not qualify for a CVE
CVE: CVE-2020-10212
Published: 2020-03-07
Description: upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF attempt may succeed if a .ico filename is added to the PATH_INFO. Also, an attacker could create a DNS hostname that resolves to the 0.0.0.0 IP address for DNS pinning. NOTE: this issue exists because of an incomplete fix for CVE-2018-14728.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/trippo/ResponsiveFilemanager/issues/598; https://github.com/trippo/ResponsiveFilemanager/issues/598
CVE: CVE-2020-8634
Published: 2020-03-07
Description: Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files being saved with world-readable and world-writable permissions. If a sensitive system file were edited this way, a low-privilege user may escalate privileges to root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php; https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php
CVE: CVE-2020-8635
Published: 2020-03-07
Description: Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and escalate privileges within the operating system by modifying system files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php; https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php
CVE: CVE-2020-10213
Published: 2020-03-07
Description: An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wps_sta_enrollee_pin parameter in a set_sta_enrollee_pin.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/kuc001/IoTFirmware/blob/master/D-Link/vulnerability3.md; https://github.com/kuc001/IoTFirmware/blob/master/Trendnet/Trendnet-TEW-632.pdf; https://github.com/kuc001/IoTFirmware/blob/master/D-Link/vulnerability3.md
CVE: CVE-2020-10214
Published: 2020-03-07
Description: An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binary. It allows an authenticated user to execute arbitrary code via a POST to ntp_sync.cgi with a sufficiently long parameter ntp_server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/kuc001/IoTFirmware/blob/master/D-Link/vulnerability4.md; https://github.com/kuc001/IoTFirmware/blob/master/D-Link/vulnerability4.md
CVE: CVE-2020-10215
Published: 2020-03-07
Description: An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dns_query_name parameter in a dns_query.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/kuc001/IoTFirmware/blob/master/D-Link/vulnerability2.md; https://github.com/kuc001/IoTFirmware/blob/master/Trendnet/Trendnet-TEW-632.pdf; https://github.com/kuc001/IoTFirmware/blob/master/D-Link/vulnerability2.md
CVE: CVE-2020-10216
Published: 2020-03-07
Description: An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a system_time.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/kuc001/IoTFirmware/blob/master/D-Link/vulnerability1.md; https://github.com/kuc001/IoTFirmware/blob/master/Trendnet/Trendnet-TEW-632.pdf; https://github.com/kuc001/IoTFirmware/blob/master/D-Link/vulnerability1.md
CVE: CVE-2020-8439
Published: 2020-03-07
Description: Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-425
References: http://uploadboy.me/cn40ne6p89t6/POC.mp4.html; https://cert.ikiu.ac.ir/public-files/pages/attachments/11/02630f153869936d555a79f89d717f9c.pdf; http://uploadboy.me/cn40ne6p89t6/POC.mp4.html
CVE: CVE-2020-9281
Published: 2020-03-07
Description: A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ckeditor/ckeditor4; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE/
CVE: CVE-2020-9470
Published: 2020-03-07
Description: An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling session cookies, a local user may view the contents of the session and session_admin directories, which expose active session cookies within the Wing FTP HTTP interface and administration panel. These cookies may be used to hijack user and administrative sessions, including the ability to execute Lua commands as root within the administration panel.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.hooperlabs.xyz/disclosures/cve-2020-9470.php; https://www.hooperlabs.xyz/disclosures/cve-2020-9470.php
CVE: CVE-2020-10220
Published: 2020-03-07
Description: An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/156688/rConfig-3.9-SQL-Injection.html; http://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Execution.html; http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.html
CVE: CVE-2020-10221
Published: 2020-03-08
Description: lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/156687/rConfig-3.93-Authenticated-Remote-Code-Execution.html; https://cwe.mitre.org/data/definitions/78.html; https://engindemirbilek.github.io/rconfig-3.93-rce
CVE: CVE-2020-10222
Published: 2020-03-08
Description: npdf.dll in Nitro Pro before 13.13.2.242 is vulnerable to Heap Corruption at npdf!nitro::get_property+2381 via a crafted PDF document.
CVSS Score: 8.1 (HIGH)
References: https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2020-03-05-fuzzing-heap-corruption-nitro-pdf-vulnerability.md; https://nafiez.github.io/security/vulnerability/corruption/fuzzing/2020/03/05/fuzzing-heap-corruption-nitro-pdf-vulnerability.html; https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2020-03-05-fuzzing-heap-corruption-nitro-pdf-vulnerability.md
CVE: CVE-2020-10223
Published: 2020-03-08
Description: npdf.dll in Nitro Pro before 13.13.2.242 is vulnerable to JBIG2Decode CNxJBIG2DecodeStream Heap Corruption at npdf!CAPPDAnnotHandlerUtils::create_popup_for_markup+0x12fbe via a crafted PDF document.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2020-03-05-fuzzing-heap-corruption-nitro-pdf-vulnerability.md; https://nafiez.github.io/security/vulnerability/corruption/fuzzing/2020/03/05/fuzzing-heap-corruption-nitro-pdf-vulnerability.html; https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2020-03-05-fuzzing-heap-corruption-nitro-pdf-vulnerability.md
CVE: CVE-2020-10224
Published: 2020-03-08
Description: An unauthenticated file upload vulnerability has been identified in admin_add.php in PHPGurukul Online Book Store 1.0. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to the server, including PHP files, which could result in command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://tib3rius.com/cves.html; https://www.exploit-db.com/exploits/47887; https://tib3rius.com/cves.html
CVE: CVE-2020-10225
Published: 2020-03-08
Description: An unauthenticated file upload vulnerability has been identified in admin/gallery.php in PHPGurukul Job Portal 1.0. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to the server, including PHP files, which could result in command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://tib3rius.com/cves.html; https://www.exploit-db.com/exploits/47881; https://tib3rius.com/cves.html
CVE: CVE-2020-10232
Published: 2020-03-09
Description: In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing logic in yaffsfs_istat() in fs/yaffs.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/sleuthkit/sleuthkit/commit/459ae818fc8dae[PII_REDACTED]50de4d191ce158f1; https://lists.debian.org/debian-lts-announce/2020/03/msg00011.html; https://lists.debian.org/debian-lts-announce/2022/06/msg00015.html
CVE: CVE-2020-10233
Published: 2020-03-09
Description: In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in fs/ntfs.c.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/sleuthkit/sleuthkit/issues/1829; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5EY53OYU7UZLAJWNIVVNR3EX2RNCCFTB/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQR2QY3IAF2IG6HGBSKGL66VUDOTC3OA/
CVE: CVE-2016-11021
Published: 2020-03-09
Description: setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.exploit-db.com/exploits/39437; https://www.exploit-db.com/exploits/39437; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-11021
CVE: CVE-2019-20504
Published: 2020-03-09
Description: service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code via shell metacharacters in the kuid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.rcesecurity.com/2019/04/dell-kace-k1000-remote-code-execution-the-story-of-bug-k1-18652/; https://www.rcesecurity.com/2019/04/dell-kace-k1000-remote-code-execution-the-story-of-bug-k1-18652/
CVE: CVE-2015-7343
Published: 2020-03-09
Description: JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://labs.integrity.pt/advisories/cve-2015-7343/; https://labs.integrity.pt/advisories/cve-2015-7343/
CVE: CVE-2015-7344
Published: 2020-03-09
Description: HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://labs.integrity.pt/advisories/cve-2015-7344/; https://labs.integrity.pt/advisories/cve-2015-7344/
CVE: CVE-2015-7968
Published: 2020-03-09
Description: nwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbc_ext2int/ URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-611
References: https://labs.integrity.pt/advisories/cve-2015-7968/; https://labs.integrity.pt/advisories/cve-2015-7968/
CVE: CVE-2020-9282
Published: 2020-03-09
Description: In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, certain personal information is discoverable inspecting network responses on the 'Edit access' screen when sharing portfolios.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://bugs.launchpad.net/mahara/+bug/1863043; https://mahara.org/interaction/forum/topic.php?id=8590; https://bugs.launchpad.net/mahara/+bug/1863043
CVE: CVE-2020-4217
Published: 2020-03-09
Description: The IBM Spectrum Scale 4.2 and 5.0 file system component is affected by a denial of service security vulnerability. An attacker can force the Spectrum Scale mmfsd/mmsdrserv daemons to unexpectedly exit, impacting the functionality of the Spectrum Scale cluster and the availability of file systems managed by Spectrum Scale. IBM X-Force ID: 175067.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175067; https://www.ibm.com/support/pages/node/5693463; https://exchange.xforce.ibmcloud.com/vulnerabilities/175067
CVE: CVE-2019-10806
Published: 2020-03-09
Description: vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1321
References: https://github.com/vega/vega/commit/8f33a0b5170d7de4f12fc248ec[PII_REDACTED]367b; https://snyk.io/vuln/SNYK-JS-VEGAUTIL-559223; https://github.com/vega/vega/commit/8f33a0b5170d7de4f12fc248ec[PII_REDACTED]367b
CVE: CVE-2019-20226
Published: 2020-03-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none
CVE: CVE-2020-10175
Published: 2020-03-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-10235
Published: 2020-03-09
Description: An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-116
References: https://bugzilla.suse.com/show_bug.cgi?id=1165721; https://github.com/Froxlor/Froxlor/commit/62ce21c9ec393f9962515c88f0c489ace42bf656; https://github.com/Froxlor/Froxlor/commit/7e361274c5bf687b6a42dd1871f6d75506c5d207
CVE: CVE-2020-10236
Published: 2020-03-09
Description: An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.suse.com/show_bug.cgi?id=1165718; https://github.com/Froxlor/Froxlor/commit/6b09720ef8a1cc008751dd0ca0140a0597fedce5; https://github.com/Froxlor/Froxlor/compare/0.10.13...0.10.14
CVE: CVE-2020-10237
Published: 2020-03-09
Description: An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-362
References: https://bugzilla.suse.com/show_bug.cgi?id=1165719; https://bugzilla.suse.com/show_bug.cgi?id=1165719
CVE: CVE-2020-1706
Published: 2020-03-09
Description: It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/apb-tools-container.
CVSS Score: 7.0 (HIGH)
CWE: CWE-732, CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1706; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1706
CVE: CVE-2020-1737
Published: 2020-03-09
Description: A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737; https://github.com/ansible/ansible/issues/67795; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/
CVE: CVE-2020-2134
Published: 2020-03-09
Description: Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted constructor bodies.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1754; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2135
Published: 2020-03-09
Description: Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterceptable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1754; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2136
Published: 2020-03-09
Description: Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1723; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2137
Published: 2020-03-09
Description: Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1784; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2138
Published: 2020-03-09
Description: Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1700; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2139
Published: 2020-03-09
Description: An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any file on the Jenkins master file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1668; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2140
Published: 2020-03-09
Description: Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1722; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2141
Published: 2020-03-09
Description: A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Perforce.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1765; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2142
Published: 2020-03-09
Description: A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1765; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2143
Published: 2020-03-09
Description: Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1516; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2144
Published: 2020-03-09
Description: Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1702; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2145
Published: 2020-03-09
Description: Jenkins Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text on the Jenkins master file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1596; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2146
Published: 2020-03-09
Description: Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.
CVSS Score: 7.4 (HIGH)
CWE: CWE-347
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1692; http://www.openwall.com/lists/oss-security/2020/03/09/1
CVE: CVE-2020-2147
Published: 2020-03-09
Description: A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2020/03/09/1; https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1761; http://www.openwall.com/lists/oss-security/2020/03/09/1