CVE-2014-2066

jenkins: session fixation issue (SECURITY-75)

Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.

CVSS 2.0 · 6.8 Medium EPSS 2.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-2065

jenkins: input validation issue (SECURITY-77)

Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-2064

jenkins: failed log in attemps revealing if a user is valid or not (SECURITY-79)

The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-5766

gd: Integer overflow in _gd2GetHeader() resulting in heap overflow

Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.

CVSS 3.0 · 8.8 High EPSS 7.5% KEV · Not listed

Vendors

Debian Fedoraproject Freebsd and 3 more

Products

Debian Linux Fedora Freebsd and 5 more

CVE-2014-2063

jenkins: interface vulnerable to clickjacking attacks (SECURITY-80)

Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

CVSS 2.0 · 7.5 High EPSS 2.3% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-5418

libarchive: Archive Entry with type 1 (hardlink), but has a non-zero data size file overwrite

The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.

CVSS 3.0 · 7.5 High EPSS 4.7% KEV · Not listed

Vendors

Libarchive Oracle Redhat

Products

Libarchive Linux Enterprise Linux and 8 more

CVE-2014-2062

jenkins: user tokens not invalidated correctly (SECURITY-89)

Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token.

CVSS 2.0 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-5392

Kubernetes: disclosure of information in multi tenant environments via watch-cache list

The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of other project names to obtain sensitive project and user information via vectors related to the watch-cache list.

CVSS 3.0 · 6.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2016-5325

nodejs: reason argument in ServerResponse#writeHead() not properly validated

CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

CVSS 3.0 · 6.1 Medium EPSS 4.1% KEV · Not listed

Vendors

Nodejs Redhat Suse

Products

Node.js Openshift Rhel Software Collections and 1 more

CVE-2014-2061

jenkins: clear text password disclosure (SECURITY-93)

The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.

CVSS 2.0 · 5.0 Medium EPSS 2.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-3738

origin: pod update allows docker socket access via build-pod

Red Hat OpenShift Enterprise 3.2 does not properly restrict access to STI builds, which allows remote authenticated users to access the Docker socket and gain privileges via vectors related to build-pod.

CVSS 3.0 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2016-3727

jenkins: Granting the permission to read node configurations allows access to overall system configuration (SECURITY-281)

The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors.

CVSS 3.0 · 4.3 Medium EPSS 2.3% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-2060

jenkins: session hijacking issue in Winstone (SECURITY-106)

The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 1.5% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-3726

jenkins: Open redirect to scheme-relative URLs (SECURITY-276)

Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to "scheme-relative" URLs.

CVSS 3.0 · 7.4 High EPSS 2.3% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-3725

jenkins: Regular users can trigger download of update site metadata (SECURITY-273)

Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missing permissions check. NOTE: this issue can be combined with DNS cache poisoning to cause a denial of service (service disruption).

CVSS 3.0 · 4.3 Medium EPSS 2.4% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-2059

jenkins: command line interface job creation directory traversal (SECURITY-108)

Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name.

CVSS 2.0 · 6.5 Medium EPSS 2.6% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-3724

jenkins: Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration (SECURITY-266)

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job configuration.

CVSS 3.0 · 6.5 Medium EPSS 2.2% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-3723

jenkins: Information on installed plugins exposed via API (SECURITY-250)

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.

CVSS 3.0 · 4.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-3722

jenkins: Malicious users with multiple user accounts can prevent other users from logging in (SECURITY-243)

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name."

CVSS 3.0 · 4.3 Medium EPSS 2.3% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2016-3721

jenkins: Arbitrary build parameters are passed to build scripts as environment variables (SECURITY-170)

Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables.

CVSS 3.1 · 4.3 Medium EPSS 2.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift