deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-0757
Published: 2020-02-11
Description: An elevation of privilege vulnerability exists when Windows improperly handles Secure Socket Shell remote commands, aka 'Windows SSH Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0757; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0757
CVE: CVE-2020-0759
Published: 2020-02-11
Description: A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0759; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0759
CVE: CVE-2020-0767
Published: 2020-02-11
Description: A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0674, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0767; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0767
CVE: CVE-2020-0792
Published: 2020-02-11
Description: An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0715, CVE-2020-0745.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0792; https://www.zerodayinitiative.com/advisories/ZDI-20-259/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0792
CVE: CVE-2020-8890
Published: 2020-02-12
Description: An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when trying to block a brute-force series of invalid requests.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-367
References: https://github.com/MISP/MISP/commit/934c82819237b4edf1da64587b72a87bec5dd520; https://github.com/MISP/MISP/commit/c1a0b3b2809b21b4df8c1efbc803aff700e262c3; https://github.com/MISP/MISP/compare/v2.4.120...v2.4.121
CVE: CVE-2020-8891
Published: 2020-02-12
Description: An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests.
CVSS Score: 5.9 (MEDIUM)
References: https://github.com/MISP/MISP/commit/934c82819237b4edf1da64587b72a87bec5dd520; https://github.com/MISP/MISP/commit/c1a0b3b2809b21b4df8c1efbc803aff700e262c3; https://github.com/MISP/MISP/compare/v2.4.120...v2.4.121
CVE: CVE-2020-8892
Published: 2020-02-12
Description: An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests.
CVSS Score: 8.1 (HIGH)
References: https://github.com/MISP/MISP/commit/934c82819237b4edf1da64587b72a87bec5dd520; https://github.com/MISP/MISP/commit/c1a0b3b2809b21b4df8c1efbc803aff700e262c3; https://github.com/MISP/MISP/compare/v2.4.120...v2.4.121
CVE: CVE-2020-8893
Published: 2020-02-12
Description: An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp.
CVSS Score: 7.5 (HIGH)
References: https://github.com/MISP/MISP/commit/3d982d92fd26584115c01f8c560a688d1096b65c; https://github.com/MISP/MISP/compare/v2.4.120...v2.4.121; https://zigrin.com/advisories/misp-bruteforce-protection-not-working-in-very-specific-environments/
CVE: CVE-2020-8894
Published: 2020-02-12
Description: An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/MISP/MISP/commit/9400b8bc8699435d84508e598aca98a31affd77c; https://github.com/MISP/MISP/compare/v2.4.120...v2.4.121; https://zigrin.com/advisories/misp-mishandling-of-discussion-threads-acls/
CVE: CVE-2014-0234
Published: 2020-02-12
Description: The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: http://openwall.com/lists/oss-security/2014/06/05/19; http://www.securityfocus.com/bid/67657; https://bugzilla.redhat.com/show_bug.cgi?id=1097008
CVE: CVE-2014-2595
Published: 2020-02-12
Description: Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: http://packetstormsecurity.com/files/127740/Barracuda-WAF-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2014/Aug/5; http://www.osvdb.org/109782
CVE: CVE-2014-4968
Published: 2020-02-12
Description: The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 for Android allow remote attackers to execute arbitrary code via a crafted web site, a related issue to CVE-2012-6636.
CVSS Score: 8.8 (HIGH)
References: http://www.exploit-db.com/exploits/34088/; http://www.exploit-db.com/exploits/34088/
CVE: CVE-2014-6262
Published: 2020-02-12
Description: Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted third argument to the rrdtool.graph function, aka ZEN-15415, a related issue to CVE-2013-2131.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://www.kb.cert.org/vuls/id/449452; https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing; https://github.com/oetiker/rrdtool-1.x/commit/64ed5314af1255ab6dded45f70b39cdeab5ae2ec
CVE: CVE-2014-9390
Published: 2020-02-12
Description: Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://article.gmane.org/gmane.linux.kernel/1853266; http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html; http://mercurial.selenic.com/wiki/WhatsNew
CVE: CVE-2014-8128
Published: 2020-02-12
Description: LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://openwall.com/lists/oss-security/2015/01/24/15
CVE: CVE-2015-7508
Published: 2020-02-12
Description: Heap-based buffer overflow in the bmp_decode_rle function in libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the last row of RLE data in a crafted BMP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2015/Dec/73; http://www.securityfocus.com/archive/1/archive/1/537132/100/0/threaded; http://seclists.org/fulldisclosure/2015/Dec/73
CVE: CVE-2009-5139
Published: 2020-02-12
Description: The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916
References: http://voipsa.org/pipermail/voipsec_voipsa.org/2009-April/002946.html; https://resources.enablesecurity.com/resources/sipdigestleak-tut.pdf; http://voipsa.org/pipermail/voipsec_voipsa.org/2009-April/002946.html
CVE: CVE-2009-5140
Published: 2020-02-12
Description: The SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-307
References: http://voipsa.org/pipermail/voipsec_voipsa.org/2009-April/002946.html; https://resources.enablesecurity.com/resources/sipdigestleak-tut.pdf; http://voipsa.org/pipermail/voipsec_voipsa.org/2009-April/002946.html
CVE: CVE-2012-0810
Published: 2020-02-12
Description: The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stack corruption and panic) via a crafted application that triggers certain lock contention.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=794557; https://git.kernel.org/pub/scm/linux/kernel/git/rt/linux-stable-rt.git/commit/?id=bcf6b1d78c0bde228929c388978ed3af9a623463; https://git.kernel.org/pub/scm/linux/kernel/git/rt/linux-stable-rt.git/commit/?id=e5d4e1c3ccee18c68f23d62ba77bda26e893d4f0
CVE: CVE-2013-7378
Published: 2020-02-12
Description: scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://www.openwall.com/lists/oss-security/2014/05/13/1; http://www.openwall.com/lists/oss-security/2014/05/15/2; https://github.com/github/hubot-scripts/commit/feee5abdb038a229a98969ae443cdb8a61747782
CVE: CVE-2014-2560
Published: 2020-02-12
Description: The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916
References: https://seclists.org/bugtraq/2014/Mar/185; https://seclists.org/bugtraq/2014/Mar/185
CVE: CVE-2014-4607
Published: 2020-02-12
Description: Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html; https://web.archive.org/web/[PII_REDACTED]3922/http://www.oberhumer.com/opensource/lzo/; http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html
CVE: CVE-2019-20098
Published: 2020-02-12
Description: The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://jira.atlassian.com/browse/JRASERVER-70605; https://www.tenable.com/security/research/tra-2020-05; https://jira.atlassian.com/browse/JRASERVER-70605
CVE: CVE-2019-20099
Published: 2020-02-12
Description: The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://jira.atlassian.com/browse/JRASERVER-70606; https://www.tenable.com/security/research/tra-2020-05; https://jira.atlassian.com/browse/JRASERVER-70606
CVE: CVE-2019-20100
Published: 2020-02-12
Description: The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are affected: all versions prior to 5.4.21, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.2, and from version 7.1.0 before version 7.1.3. The vulnerable plugin is used by Atlassian Jira Server and Data Center before version 8.7.0. An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-352
References: https://ecosystem.atlassian.net/browse/APL-1390; https://jira.atlassian.com/browse/JRASERVER-70607; https://www.tenable.com/security/research/tra-2020-06
CVE: CVE-2013-1410
Published: 2020-02-12
Description: Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabilities
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-database.net/?id=59355; https://www.securityfocus.com/bid/57514/info; https://www.exploit-database.net/?id=59355
CVE: CVE-2013-2010
Published: 2020-02-12
Description: WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://packetstormsecurity.com/files/130999/WordPress-W3-Total-Cache-PHP-Code-Execution.html; http://www.exploit-db.com/exploits/25137; http://www.openwall.com/lists/oss-security/2013/04/24/9
CVE: CVE-2013-7381
Published: 2020-02-12
Description: libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://www.openwall.com/lists/oss-security/2014/05/13/1; http://www.openwall.com/lists/oss-security/2014/05/15/2; https://github.com/mytrile/node-libnotify/commit/dfe7801d73a0dda10663a0ff3d0ec8b4d5f0d448
CVE: CVE-2015-5617
Published: 2020-02-12
Description: SQL injection vulnerability in pub/m_pending_news/delete_pending_news.jsp in Enorth Webpublisher CMS allows remote attackers to execute arbitrary SQL commands via the cbNewsId parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/133082/Enorth-Webpublisher-CMS-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Aug/55; http://packetstormsecurity.com/files/133082/Enorth-Webpublisher-CMS-SQL-Injection.html
CVE: CVE-2015-7890
Published: 2020-02-12
Description: Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local users to cause a denial of service (memory corruption) via a large (1) buffer or (2) size parameter.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: http://packetstormsecurity.com/files/134106/Samsung-Seiren-Kernel-Driver-Buffer-Overflow.html; https://code.google.com/p/google-security-research/issues/detail?id=491; https://www.exploit-db.com/exploits/38556/
CVE: CVE-2019-19194
Published: 2020-02-12
Description: The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x through 1.3.0, and TLSR826x through 3.3 devices installs a zero long term key (LTK) if an out-of-order link-layer encryption request is received during Secure Connections pairing. An attacker in radio range can have arbitrary read/write access to protected GATT service data, cause a device crash, or possibly control a device's function by establishing an encrypted session with the zero LTK.
CVSS Score: 8.8 (HIGH)
References: http://www.telink-semi.com/ble; https://asset-group.github.io/disclosures/sweyntooth/; http://www.telink-semi.com/ble
CVE: CVE-2019-19196
Published: 2020-02-12
Description: The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x through 1.3.0, and TLSR826x through 3.3 devices accepts a pairing request with a key size greater than 16 bytes, allowing an attacker in radio range to cause a buffer overflow and denial of service (crash) via crafted packets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: http://www.telink-semi.com/ble; https://asset-group.github.io/disclosures/sweyntooth/; http://www.telink-semi.com/ble
CVE: CVE-2019-19921
Published: 2020-02-12
Description: runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)
CVSS Score: 7.0 (HIGH)
CWE: CWE-706
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00018.html; https://access.redhat.com/errata/RHSA-2020:0688; https://access.redhat.com/errata/RHSA-2020:0695
CVE: CVE-2020-2109
Published: 2020-02-12
Description: Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1710; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2110
Published: 2020-02-12
Description: Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1713; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2111
Published: 2020-02-12
Description: Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1725; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2112
Published: 2020-02-12
Description: Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1709; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2113
Published: 2020-02-12
Description: Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1709; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2114
Published: 2020-02-12
Description: Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1684; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2115
Published: 2020-02-12
Description: Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1752; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2116
Published: 2020-02-12
Description: A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-812%20%281%29; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2117
Published: 2020-02-12
Description: A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-812%20%281%29; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2118
Published: 2020-02-12
Description: A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-812%20%282%29; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2119
Published: 2020-02-12
Description: Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1717; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2120
Published: 2020-02-12
Description: Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1751; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2121
Published: 2020-02-12
Description: Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
CVSS Score: 8.8 (HIGH)
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1731; http://www.openwall.com/lists/oss-security/2020/02/12/3