Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,139

Export CSV
CVE-2022-36881

jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client

Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.

CVSS 3.1 · 8.1 High EPSS 1.0% KEV · Not listed
Vendors
Jenkins Redhat
Products
Git Client Openshift
CVE-2022-34177

jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin

Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Jenkins Redhat
Products
Pipeline\ Openshift
CVE-2022-34176

jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin

Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.

CVSS 3.1 · 5.4 Medium EPSS 77.5% KEV · Not listed
Vendors
Jenkins Redhat
Products
Junit Openshift
CVE-2022-34174

jenkins: Observable timing discrepancy allows determining username validity

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2022-32190

Failure to strip relative path components in net/url

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Golang Redhat
Products
Go Ceph Storage Container Native Virtualization and 7 more
CVE-2022-30954

plugin: missing permission checks in Blue Ocean Plugin

Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins Redhat
Products
Blue Ocean Ocp Tools Openshift
CVE-2022-30953

plugin: CSRF vulnerability in Blue Ocean Plugin

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins Redhat
Products
Blue Ocean Ocp Tools Openshift
CVE-2022-30952

plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin

Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Jenkins Redhat
Products
Blue Ocean Ocp Tools Openshift
CVE-2022-30948

plugin: Mercurial SCM plugin can check out from the controller file system

Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Jenkins Redhat
Products
Mercurial Openshift
CVE-2022-30946

plugin: CSRF vulnerability in Script Security Plugin

A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins Redhat
Products
Script Security Openshift
CVE-2022-30945

plugin: Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Pipeline: Groovy Plugin

Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines.

CVSS 3.1 · 8.5 High EPSS 1.4% KEV · Not listed
Vendors
Jenkins Redhat
Products
Pipeline\ Openshift
CVE-2022-30632

Stack exhaustion on crafted paths in path/filepath

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Application Interconnect and 15 more
CVE-2022-30322

go-getter: unsafe download (issue 2 of 3)

go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0.

CVSS 3.1 · 8.6 High EPSS 1.5% KEV · Not listed
Vendors
Hashicorp Redhat
Products
Go-getter Openshift Openstack
CVE-2022-30321

go-getter: unsafe download (issue 1 of 3)

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.

CVSS 3.1 · 8.6 High EPSS 3.1% KEV · Not listed
Vendors
Hashicorp Redhat
Products
Go-getter Openshift Openstack
CVE-2022-2990

buildah: possible information disclosure and modification

An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Buildah Project Redhat
Products
Buildah Enterprise Linux Openshift and 1 more
CVE-2022-2832

blender: Null pointer reference in blender thumbnail extractor

A flaw was found in Blender 3.3.0. A null pointer dereference exists in source/blender/gpu/opengl/gl_backend.cc that may lead to loss of confidentiality and integrity.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Blender Redhat
Products
Blender Openshift Sandboxed Containers
CVE-2022-2403

openshift: oauth-serving-cert configmap contains cluster certificate private key

A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serving-cert ConfigMaps, and accessible to any authenticated OpenShift user or service-account. A malicious user could exploit this flaw by reading the oauth-serving-cert ConfigMap in the openshift-config-managed namespace, compromising any web traffic secured using that certificate.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2022-2132

dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs

A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.

CVSS 3.1 · 8.6 High EPSS 2.4% KEV · Not listed
Vendors
Debian Dpdk Fedoraproject and 1 more
Products
Debian Linux Data Plane Development Kit Fedora and 12 more