Vulnerability-Lookup

RHSA-2016:0070

Vulnerability from csaf_redhat - Published: 2016-01-26 19:12 - Updated: 2026-06-27 10:35

Summary

Red Hat Security Advisory: Red Hat OpenShift Enterprise 3.1.1 bug fix and enhancement update

Severity

Important

Notes

Topic: Red Hat OpenShift Enterprise release 3.1.1 is now available with updates to packages that fix several security issues, bugs and introduce feature enhancements. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Details: OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments. The following security issues are addressed with this release: An authorization flaw was discovered in Kubernetes; the API server did not properly check user permissions when handling certain requests. An authenticated remote attacker could use this flaw to gain additional access to resources such as RAM and disk space. (CVE-2016-1905) An authorization flaw was discovered in Kubernetes; the API server did not properly check user permissions when handling certain build- configuration strategies. A remote attacker could create build configurations with strategies that violate policy. Although the attacker could not launch the build themselves (launch fails when the policy is violated), if the build configuration files were later launched by other privileged services (such as automated triggers), user privileges could be bypassed allowing attacker escalation. (CVE-2016-1906) An update for Jenkins Continuous Integration Server that addresses a large number of security issues including XSS, CSRF, information disclosure and code execution have been addressed as well. (CVE-2013-2186, CVE-2014-1869, CVE-2014-3661, CVE-2014-3662 CVE-2014-3663, CVE-2014-3664, CVE-2014-3666, CVE-2014-3667 CVE-2014-3680, CVE-2014-3681, CVE-2015-1806, CVE-2015-1807 CVE-2015-1808, CVE-2015-1810, CVE-2015-1812, CVE-2015-1813 CVE-2015-1814, CVE-2015-5317, CVE-2015-5318, CVE-2015-5319 CVE-2015-5320, CVE-2015-5321, CVE-2015-5322, CVE-2015-5323 CVE-2015-5324, CVE-2015-5325, CVE-2015-5326 ,CVE-2015-7537 CVE-2015-7538, CVE-2015-7539, CVE-2015-8103) Space precludes documenting all of the bug fixes and enhancements in this advisory. See the OpenShift Enterprise 3.1 Release Notes, which will be updated shortly for release 3.1.1, for details about these changes: https://docs.openshift.com/enterprise/3.1/release_notes/ose_3_1_release_notes.html All OpenShift Enterprise 3 users are advised to upgrade to these updated packages.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2013-2186

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.

7.5 ()


                
                  AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-626 - Null Byte Interaction Error (Poison Null Byte)

Affected products

Fixed 254 products

Product	Version	Remediation
Unresolved product id: 7Server-RH7-RHOSE-3.1:atomic-openshift-0:3.1.1.6-1.git.0.b57e8bd.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:atomic-openshift-0:3.1.1.6-1.git.0.b57e8bd.el7aos.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:atomic-openshift-clients-0:3.1.1.6-1.git.0.b57e8bd.el7aos.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:atomic-openshift-clients-redistributable-0:3.1.1.6-1.git.0.b57e8bd.el7aos.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:atomic-openshift-dockerregistry-0:3.1.1.6-1.git.0.b57e8bd.el7aos.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:atomic-openshift-master-0:3.1.1.6-1.git.0.b57e8bd.el7aos.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:atomic-openshift-node-0:3.1.1.6-1.git.0.b57e8bd.el7aos.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:atomic-openshift-pod-0:3.1.1.6-1.git.0.b57e8bd.el7aos.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:atomic-openshift-recycle-0:3.1.1.6-1.git.0.b57e8bd.el7aos.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:atomic-openshift-sdn-ovs-0:3.1.1.6-1.git.0.b57e8bd.el7aos.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:atomic-openshift-utils-0:3.0.35-1.git.0.6a386dd.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:heapster-0:0.18.2-3.gitaf4752e.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:heapster-0:0.18.2-3.gitaf4752e.el7aos.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:jenkins-0:1.625.3-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:jenkins-0:1.625.3-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-align-text-0:0.1.3-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-align-text-0:0.1.3-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-ansi-green-0:0.1.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-ansi-green-0:0.1.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-ansi-wrap-0:0.1.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-ansi-wrap-0:0.1.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-anymatch-0:1.3.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-anymatch-0:1.3.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-arr-diff-0:2.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-arr-diff-0:2.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-arr-flatten-0:1.0.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-arr-flatten-0:1.0.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-array-unique-0:0.2.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-array-unique-0:0.2.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-arrify-0:1.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-arrify-0:1.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-async-each-0:1.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-async-each-0:1.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-binary-extensions-0:1.3.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-binary-extensions-0:1.3.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-braces-0:1.8.2-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-braces-0:1.8.2-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-capture-stack-trace-0:1.0.0-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-capture-stack-trace-0:1.0.0-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-chokidar-0:1.4.1-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-chokidar-0:1.4.1-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-configstore-0:1.4.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-configstore-0:1.4.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-create-error-class-0:2.0.1-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-create-error-class-0:2.0.1-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-deep-extend-0:0.3.2-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-deep-extend-0:0.3.2-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-duplexer-0:0.1.1-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-duplexer-0:0.1.1-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-duplexify-0:3.4.2-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-duplexify-0:3.4.2-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-end-of-stream-0:1.1.0-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-end-of-stream-0:1.1.0-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-error-ex-0:1.2.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-error-ex-0:1.2.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-es6-promise-0:3.0.2-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-es6-promise-0:3.0.2-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-event-stream-0:3.3.2-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-event-stream-0:3.3.2-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-expand-brackets-0:0.1.4-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-expand-brackets-0:0.1.4-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-expand-range-0:1.8.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-expand-range-0:1.8.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-extglob-0:0.3.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-extglob-0:0.3.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-filename-regex-0:2.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-filename-regex-0:2.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-fill-range-0:2.2.3-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-fill-range-0:2.2.3-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-for-in-0:0.1.4-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-for-in-0:0.1.4-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-for-own-0:0.1.3-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-for-own-0:0.1.3-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-from-0:0.1.3-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-from-0:0.1.3-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-glob-base-0:0.3.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-glob-base-0:0.3.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-glob-parent-0:2.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-glob-parent-0:2.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-got-0:5.2.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-got-0:5.2.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-graceful-fs-0:4.1.2-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-graceful-fs-0:4.1.2-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-ini-0:1.1.0-6.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-ini-0:1.1.0-6.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-binary-path-0:1.0.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-binary-path-0:1.0.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-dotfile-0:1.0.2-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-dotfile-0:1.0.2-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-equal-shallow-0:0.1.3-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-equal-shallow-0:0.1.3-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-extendable-0:0.1.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-extendable-0:0.1.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-extglob-0:1.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-extglob-0:1.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-glob-0:2.0.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-glob-0:2.0.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-npm-0:1.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-npm-0:1.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-number-0:2.1.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-number-0:2.1.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-plain-obj-0:1.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-plain-obj-0:1.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-primitive-0:2.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-primitive-0:2.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-redirect-0:1.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-redirect-0:1.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-stream-0:1.0.1-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-is-stream-0:1.0.1-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-isobject-0:2.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-isobject-0:2.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-kind-of-0:3.0.2-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-kind-of-0:3.0.2-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-latest-version-0:2.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-latest-version-0:2.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lazy-cache-0:1.0.2-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lazy-cache-0:1.0.2-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.assign-0:3.2.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.assign-0:3.2.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.baseassign-0:3.2.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.baseassign-0:3.2.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.basecopy-0:3.0.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.basecopy-0:3.0.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.bindcallback-0:3.0.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.bindcallback-0:3.0.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.createassigner-0:3.1.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.createassigner-0:3.1.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.defaults-0:3.1.2-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.defaults-0:3.1.2-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.getnative-0:3.9.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.getnative-0:3.9.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.isarguments-0:3.0.4-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.isarguments-0:3.0.4-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.isarray-0:3.0.4-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.isarray-0:3.0.4-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.isiterateecall-0:3.0.9-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.isiterateecall-0:3.0.9-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.keys-0:3.1.2-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.keys-0:3.1.2-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.restparam-0:3.6.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lodash.restparam-0:3.6.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lowercase-keys-0:1.0.0-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-lowercase-keys-0:1.0.0-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-map-stream-0:0.1.0-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-map-stream-0:0.1.0-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-micromatch-0:2.3.5-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-micromatch-0:2.3.5-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-mkdirp-0:0.5.0-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-mkdirp-0:0.5.0-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-node-status-codes-0:1.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-node-status-codes-0:1.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-nodemon-0:1.8.1-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-nodemon-0:1.8.1-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-normalize-path-0:2.0.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-normalize-path-0:2.0.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-object-assign-0:4.0.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-object-assign-0:4.0.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-object.omit-0:2.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-object.omit-0:2.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-optimist-0:0.4.0-5.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-optimist-0:0.4.0-5.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-os-homedir-0:1.0.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-os-homedir-0:1.0.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-os-tmpdir-0:1.0.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-os-tmpdir-0:1.0.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-osenv-0:0.1.0-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-osenv-0:0.1.0-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-package-json-0:2.3.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-package-json-0:2.3.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-parse-glob-0:3.0.4-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-parse-glob-0:3.0.4-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-parse-json-0:2.2.0-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-parse-json-0:2.2.0-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-pause-stream-0:0.0.11-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-pause-stream-0:0.0.11-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-pinkie-0:2.0.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-pinkie-0:2.0.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-pinkie-promise-0:2.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-pinkie-promise-0:2.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-prepend-http-0:1.0.1-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-prepend-http-0:1.0.1-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-preserve-0:0.2.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-preserve-0:0.2.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-ps-tree-0:1.0.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-ps-tree-0:1.0.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-randomatic-0:1.1.5-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-randomatic-0:1.1.5-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-rc-0:1.1.2-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-rc-0:1.1.2-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-read-all-stream-0:3.0.1-3.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-read-all-stream-0:3.0.1-3.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-readdirp-0:2.0.0-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-readdirp-0:2.0.0-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-regex-cache-0:0.4.2-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-regex-cache-0:0.4.2-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-registry-url-0:3.0.3-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-registry-url-0:3.0.3-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-repeat-element-0:1.1.2-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-repeat-element-0:1.1.2-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-semver-0:5.1.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-semver-0:5.1.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-semver-diff-0:2.1.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-semver-diff-0:2.1.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-slide-0:1.1.5-3.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-slide-0:1.1.5-3.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-split-0:0.3.3-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-split-0:0.3.3-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-stream-combiner-0:0.2.1-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-stream-combiner-0:0.2.1-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-string-length-0:1.0.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-string-length-0:1.0.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-strip-json-comments-0:1.0.2-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-strip-json-comments-0:1.0.2-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-success-symbol-0:0.1.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-success-symbol-0:0.1.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-through-0:2.3.4-4.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-through-0:2.3.4-4.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-timed-out-0:2.0.0-3.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-timed-out-0:2.0.0-3.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-touch-0:1.0.0-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-touch-0:1.0.0-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-undefsafe-0:0.0.3-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-undefsafe-0:0.0.3-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-unzip-response-0:1.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-unzip-response-0:1.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-update-notifier-0:0.6.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-update-notifier-0:0.6.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-url-parse-lax-0:1.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-url-parse-lax-0:1.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-uuid-0:2.0.1-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-uuid-0:2.0.1-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-write-file-atomic-0:1.1.2-2.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-write-file-atomic-0:1.1.2-2.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-xdg-basedir-0:2.0.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nodejs-xdg-basedir-0:2.0.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nss_wrapper-0:1.0.3-1.el7.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nss_wrapper-0:1.0.3-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:nss_wrapper-debuginfo-0:1.0.3-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:openshift-ansible-0:3.0.35-1.git.0.6a386dd.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:openshift-ansible-0:3.0.35-1.git.0.6a386dd.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:openshift-ansible-docs-0:3.0.35-1.git.0.6a386dd.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:openshift-ansible-filter-plugins-0:3.0.35-1.git.0.6a386dd.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:openshift-ansible-lookup-plugins-0:3.0.35-1.git.0.6a386dd.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:openshift-ansible-playbooks-0:3.0.35-1.git.0.6a386dd.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:openshift-ansible-roles-0:3.0.35-1.git.0.6a386dd.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:openvswitch-0:2.4.0-1.el7.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:openvswitch-0:2.4.0-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:openvswitch-debuginfo-0:2.4.0-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:openvswitch-devel-0:2.4.0-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:openvswitch-test-0:2.4.0-1.el7.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:origin-kibana-0:0.5.0-1.el7aos.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:origin-kibana-0:0.5.0-1.el7aos.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:python-openvswitch-0:2.4.0-1.el7.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOSE-3.1:tuned-profiles-atomic-openshift-node-0:3.1.1.6-1.git.0.b57e8bd.el7aos.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2014-1869

Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M. Greene, allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters).

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2014-3661

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.

5.0 ()


                
                  AV:N/AC:L/Au:N/C:N/I:N/A:P

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2014-3662

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts.

5.0 ()


                
                  AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2014-3663

Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary jobs via unspecified vectors.

5.0 ()


                
                  AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-863 - Incorrect Authorization

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2014-3664

Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.

5.0 ()


                
                  AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2014-3666

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Important

CVE-2014-3667

Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.

5.0 ()


                
                  AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-285 - Improper Authorization

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2014-3680

Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized job by reading the DOM.

5.0 ()


                
                  AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Important

CVE-2014-3681

Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-1806

It was found that the combination filter Groovy script could allow a remote attacker to potentially execute arbitrary code on a Jenkins master.

6.5 ()


                
                  AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-1807

It was found that when building artifacts, the Jenkins server would follow symbolic links, potentially resulting in disclosure of information on the server.

4.0 ()


                
                  AV:N/AC:L/Au:S/C:P/I:N/A:N

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-1808

A denial of service flaw was found in the way Jenkins handled certain update center data. An authenticated user could provide specially crafted update center data to Jenkins, causing plug-in and tool installation to not work properly.

3.5 ()


                
                  AV:N/AC:M/Au:S/C:N/I:N/A:P

CWE-20 - Improper Input Validation

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-1810

It was discovered that the internal Jenkins user database did not restrict access to reserved names, allowing users to escalate privileges.

4.6 ()


                
                  AV:N/AC:H/Au:S/C:P/I:P/A:P

CWE-20 - Improper Input Validation

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-1812

Two cross-site scripting (XSS) flaws were found in Jenkins. A remote attacker could use these flaws to conduct XSS attacks against users of an application using Jenkins.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-1813

Two cross-site scripting (XSS) flaws were found in Jenkins. A remote attacker could use these flaws to conduct XSS attacks against users of an application using Jenkins.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-1814

A flaw was found in the Jenkins API token-issuing service. The service was not properly protected against anonymous users, potentially allowing remote attackers to escalate privileges.

7.5 ()


                
                  AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-284 - Improper Access Control

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Important

CVE-2015-5317

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.

5.0 ()


                
                  AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Exploit Status CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Impact Low

CVE-2015-5318

Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-352 - Cross-Site Request Forgery (CSRF)

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-5319

XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an "XML-aware tool," as demonstrated by get-job and update-job.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:P/I:N/A:N

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Low

CVE-2015-5320

Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave.

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Important

CVE-2015-5321

The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages.

5.0 ()


                
                  AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-5322

Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:P/I:N/A:N

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Low

CVE-2015-5323

Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.

3.6 ()


                
                  AV:N/AC:H/Au:S/C:P/I:P/A:N

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-5324

Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-5325

Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665.

4.9 ()


                
                  AV:N/AC:M/Au:S/C:P/I:P/A:N

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-5326

Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message.

3.5 ()


                
                  AV:N/AC:M/Au:S/C:N/I:P/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Low

CVE-2015-7537

Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-352 - Cross-Site Request Forgery (CSRF)

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-7538

Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-352 - Cross-Site Request Forgery (CSRF)

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-7539

The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin.

5.1 ()


                
                  AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2015-8103

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-502 - Deserialization of Untrusted Data

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Important

CVE-2016-1905

An authorization flaw was discovered in Kubernetes; the API server did not properly check user permissions when handling certain requests. An authenticated remote attacker could use this flaw to gain additional access to resources such as RAM and disk space.

4.0 ()


                
                  AV:N/AC:L/Au:S/C:N/I:P/A:N

CWE-285 - Improper Authorization

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

CVE-2016-1906

An authorization flaw was discovered in Kubernetes; the API server did not properly check user permissions when handling certain build-configuration strategies. A remote attacker could create build configurations with strategies that violate policy. Although the attacker could not launch the build themselves (launch fails when the policy is violated), if the build configuration files were later launched by other privileged services (such as automated triggers), user privileges could be bypassed allowing attacker escalation.

4.6 ()


                
                  AV:N/AC:H/Au:S/C:P/I:P/A:P

CWE-285 - Improper Authorization

Affected products

Fixed 254 products, the same list as for CVE-2013-2186

Threats

Impact Moderate

References

206 references

URL	Category
https://access.redhat.com/errata/RHSA-2016:0070	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=974814	external
https://bugzilla.redhat.com/show_bug.cgi?id=1063099	external
https://bugzilla.redhat.com/show_bug.cgi?id=1147758	external
https://bugzilla.redhat.com/show_bug.cgi?id=1147759	external
https://bugzilla.redhat.com/show_bug.cgi?id=1147764	external
https://bugzilla.redhat.com/show_bug.cgi?id=1147765	external
https://bugzilla.redhat.com/show_bug.cgi?id=1147766	external
https://bugzilla.redhat.com/show_bug.cgi?id=1147769	external
https://bugzilla.redhat.com/show_bug.cgi?id=1147770	external
https://bugzilla.redhat.com/show_bug.cgi?id=1148645	external
https://bugzilla.redhat.com/show_bug.cgi?id=1205615	external
https://bugzilla.redhat.com/show_bug.cgi?id=1205616	external
https://bugzilla.redhat.com/show_bug.cgi?id=1205620	external
https://bugzilla.redhat.com/show_bug.cgi?id=1205622	external
https://bugzilla.redhat.com/show_bug.cgi?id=1205623	external
https://bugzilla.redhat.com/show_bug.cgi?id=1205627	external
https://bugzilla.redhat.com/show_bug.cgi?id=1243514	external
https://bugzilla.redhat.com/show_bug.cgi?id=1247523	external
https://bugzilla.redhat.com/show_bug.cgi?id=1254880	external
https://bugzilla.redhat.com/show_bug.cgi?id=1256869	external
https://bugzilla.redhat.com/show_bug.cgi?id=1268478	external
https://bugzilla.redhat.com/show_bug.cgi?id=1273739	external
https://bugzilla.redhat.com/show_bug.cgi?id=1277329	external
https://bugzilla.redhat.com/show_bug.cgi?id=1277383	external
https://bugzilla.redhat.com/show_bug.cgi?id=1277608	external
https://bugzilla.redhat.com/show_bug.cgi?id=1278232	external
https://bugzilla.redhat.com/show_bug.cgi?id=1278630	external
https://bugzilla.redhat.com/show_bug.cgi?id=1279404	external
https://bugzilla.redhat.com/show_bug.cgi?id=1279744	external
https://bugzilla.redhat.com/show_bug.cgi?id=1279925	external
https://bugzilla.redhat.com/show_bug.cgi?id=1280216	external
https://bugzilla.redhat.com/show_bug.cgi?id=1280497	external
https://bugzilla.redhat.com/show_bug.cgi?id=1282359	external
https://bugzilla.redhat.com/show_bug.cgi?id=1282361	external
https://bugzilla.redhat.com/show_bug.cgi?id=1282362	external
https://bugzilla.redhat.com/show_bug.cgi?id=1282363	external
https://bugzilla.redhat.com/show_bug.cgi?id=1282364	external
https://bugzilla.redhat.com/show_bug.cgi?id=1282365	external
https://bugzilla.redhat.com/show_bug.cgi?id=1282366	external
https://bugzilla.redhat.com/show_bug.cgi?id=1282367	external
https://bugzilla.redhat.com/show_bug.cgi?id=1282368	external
https://bugzilla.redhat.com/show_bug.cgi?id=1282369	external
https://bugzilla.redhat.com/show_bug.cgi?id=1282371	external
https://bugzilla.redhat.com/show_bug.cgi?id=1282426	external
https://bugzilla.redhat.com/show_bug.cgi?id=1282738	external
https://bugzilla.redhat.com/show_bug.cgi?id=1283952	external
https://bugzilla.redhat.com/show_bug.cgi?id=1284506	external
https://bugzilla.redhat.com/show_bug.cgi?id=1287414	external
https://bugzilla.redhat.com/show_bug.cgi?id=1287943	external
https://bugzilla.redhat.com/show_bug.cgi?id=1288014	external
https://bugzilla.redhat.com/show_bug.cgi?id=1289603	external
https://bugzilla.redhat.com/show_bug.cgi?id=1289965	external
https://bugzilla.redhat.com/show_bug.cgi?id=1290643	external
https://bugzilla.redhat.com/show_bug.cgi?id=1290967	external
https://bugzilla.redhat.com/show_bug.cgi?id=1291795	external
https://bugzilla.redhat.com/show_bug.cgi?id=1291797	external
https://bugzilla.redhat.com/show_bug.cgi?id=1291798	external
https://bugzilla.redhat.com/show_bug.cgi?id=1292621	external
https://bugzilla.redhat.com/show_bug.cgi?id=1293251	external
https://bugzilla.redhat.com/show_bug.cgi?id=1293252	external
https://bugzilla.redhat.com/show_bug.cgi?id=1293829	external
https://bugzilla.redhat.com/show_bug.cgi?id=1293877	external
https://bugzilla.redhat.com/show_bug.cgi?id=1294115	external
https://bugzilla.redhat.com/show_bug.cgi?id=1294798	external
https://bugzilla.redhat.com/show_bug.cgi?id=1296457	external
https://bugzilla.redhat.com/show_bug.cgi?id=1297910	external
https://bugzilla.redhat.com/show_bug.cgi?id=1297916	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2013-2186	self
https://bugzilla.redhat.com/show_bug.cgi?id=974814	external
https://www.cve.org/CVERecord?id=CVE-2013-2186	external
https://nvd.nist.gov/vuln/detail/CVE-2013-2186	external
https://access.redhat.com/security/cve/CVE-2014-1869	self
https://bugzilla.redhat.com/show_bug.cgi?id=1063099	external
https://www.cve.org/CVERecord?id=CVE-2014-1869	external
https://nvd.nist.gov/vuln/detail/CVE-2014-1869	external
https://access.redhat.com/security/cve/CVE-2014-3661	self
https://bugzilla.redhat.com/show_bug.cgi?id=1147758	external
https://www.cve.org/CVERecord?id=CVE-2014-3661	external
https://nvd.nist.gov/vuln/detail/CVE-2014-3661	external
https://access.redhat.com/security/cve/CVE-2014-3662	self
https://bugzilla.redhat.com/show_bug.cgi?id=1147759	external
https://www.cve.org/CVERecord?id=CVE-2014-3662	external
https://nvd.nist.gov/vuln/detail/CVE-2014-3662	external
https://access.redhat.com/security/cve/CVE-2014-3663	self
https://bugzilla.redhat.com/show_bug.cgi?id=1147764	external
https://www.cve.org/CVERecord?id=CVE-2014-3663	external
https://nvd.nist.gov/vuln/detail/CVE-2014-3663	external
https://access.redhat.com/security/cve/CVE-2014-3664	self
https://bugzilla.redhat.com/show_bug.cgi?id=1147765	external
https://www.cve.org/CVERecord?id=CVE-2014-3664	external
https://nvd.nist.gov/vuln/detail/CVE-2014-3664	external
https://access.redhat.com/security/cve/CVE-2014-3666	self
https://bugzilla.redhat.com/show_bug.cgi?id=1147769	external
https://www.cve.org/CVERecord?id=CVE-2014-3666	external
https://nvd.nist.gov/vuln/detail/CVE-2014-3666	external
https://access.redhat.com/security/cve/CVE-2014-3667	self
https://bugzilla.redhat.com/show_bug.cgi?id=1147770	external
https://www.cve.org/CVERecord?id=CVE-2014-3667	external
https://nvd.nist.gov/vuln/detail/CVE-2014-3667	external
https://access.redhat.com/security/cve/CVE-2014-3680	self
https://bugzilla.redhat.com/show_bug.cgi?id=1148645	external
https://www.cve.org/CVERecord?id=CVE-2014-3680	external
https://nvd.nist.gov/vuln/detail/CVE-2014-3680	external
https://access.redhat.com/security/cve/CVE-2014-3681	self
https://bugzilla.redhat.com/show_bug.cgi?id=1147766	external
https://www.cve.org/CVERecord?id=CVE-2014-3681	external
https://nvd.nist.gov/vuln/detail/CVE-2014-3681	external
https://access.redhat.com/security/cve/CVE-2015-1806	self
https://bugzilla.redhat.com/show_bug.cgi?id=1205620	external
https://www.cve.org/CVERecord?id=CVE-2015-1806	external
https://nvd.nist.gov/vuln/detail/CVE-2015-1806	external
https://wiki.jenkins-ci.org/display/SECURITY/Jenk…	external
https://access.redhat.com/security/cve/CVE-2015-1807	self
https://bugzilla.redhat.com/show_bug.cgi?id=1205622	external
https://www.cve.org/CVERecord?id=CVE-2015-1807	external
https://nvd.nist.gov/vuln/detail/CVE-2015-1807	external
https://access.redhat.com/security/cve/CVE-2015-1808	self
https://bugzilla.redhat.com/show_bug.cgi?id=1205623	external
https://www.cve.org/CVERecord?id=CVE-2015-1808	external
https://nvd.nist.gov/vuln/detail/CVE-2015-1808	external
https://access.redhat.com/security/cve/CVE-2015-1810	self
https://bugzilla.redhat.com/show_bug.cgi?id=1205627	external
https://www.cve.org/CVERecord?id=CVE-2015-1810	external
https://nvd.nist.gov/vuln/detail/CVE-2015-1810	external
https://access.redhat.com/security/cve/CVE-2015-1812	self
https://bugzilla.redhat.com/show_bug.cgi?id=1205615	external
https://www.cve.org/CVERecord?id=CVE-2015-1812	external
https://nvd.nist.gov/vuln/detail/CVE-2015-1812	external
https://wiki.jenkins-ci.org/display/SECURITY/Jenk…	external
https://access.redhat.com/security/cve/CVE-2015-1813	self
https://www.cve.org/CVERecord?id=CVE-2015-1813	external
https://nvd.nist.gov/vuln/detail/CVE-2015-1813	external
https://access.redhat.com/security/cve/CVE-2015-1814	self
https://bugzilla.redhat.com/show_bug.cgi?id=1205616	external
https://www.cve.org/CVERecord?id=CVE-2015-1814	external
https://nvd.nist.gov/vuln/detail/CVE-2015-1814	external
https://access.redhat.com/security/cve/CVE-2015-5317	self
https://bugzilla.redhat.com/show_bug.cgi?id=1282359	external
https://www.cve.org/CVERecord?id=CVE-2015-5317	external
https://nvd.nist.gov/vuln/detail/CVE-2015-5317	external
https://wiki.jenkins-ci.org/display/SECURITY/Jenk…	external
https://www.cisa.gov/known-exploited-vulnerabilit…	external
https://access.redhat.com/security/cve/CVE-2015-5318	self
https://bugzilla.redhat.com/show_bug.cgi?id=1282361	external
https://www.cve.org/CVERecord?id=CVE-2015-5318	external
https://nvd.nist.gov/vuln/detail/CVE-2015-5318	external
https://access.redhat.com/security/cve/CVE-2015-5319	self
https://bugzilla.redhat.com/show_bug.cgi?id=1282362	external
https://www.cve.org/CVERecord?id=CVE-2015-5319	external
https://nvd.nist.gov/vuln/detail/CVE-2015-5319	external
https://access.redhat.com/security/cve/CVE-2015-5320	self
https://bugzilla.redhat.com/show_bug.cgi?id=1282363	external
https://www.cve.org/CVERecord?id=CVE-2015-5320	external
https://nvd.nist.gov/vuln/detail/CVE-2015-5320	external
https://access.redhat.com/security/cve/CVE-2015-5321	self
https://bugzilla.redhat.com/show_bug.cgi?id=1282364	external
https://www.cve.org/CVERecord?id=CVE-2015-5321	external
https://nvd.nist.gov/vuln/detail/CVE-2015-5321	external
https://access.redhat.com/security/cve/CVE-2015-5322	self
https://bugzilla.redhat.com/show_bug.cgi?id=1282365	external
https://www.cve.org/CVERecord?id=CVE-2015-5322	external
https://nvd.nist.gov/vuln/detail/CVE-2015-5322	external
https://access.redhat.com/security/cve/CVE-2015-5323	self
https://bugzilla.redhat.com/show_bug.cgi?id=1282366	external
https://www.cve.org/CVERecord?id=CVE-2015-5323	external
https://nvd.nist.gov/vuln/detail/CVE-2015-5323	external
https://access.redhat.com/security/cve/CVE-2015-5324	self
https://bugzilla.redhat.com/show_bug.cgi?id=1282367	external
https://www.cve.org/CVERecord?id=CVE-2015-5324	external
https://nvd.nist.gov/vuln/detail/CVE-2015-5324	external
https://access.redhat.com/security/cve/CVE-2015-5325	self
https://bugzilla.redhat.com/show_bug.cgi?id=1282368	external
https://www.cve.org/CVERecord?id=CVE-2015-5325	external
https://nvd.nist.gov/vuln/detail/CVE-2015-5325	external
https://access.redhat.com/security/cve/CVE-2015-5326	self
https://bugzilla.redhat.com/show_bug.cgi?id=1282369	external
https://www.cve.org/CVERecord?id=CVE-2015-5326	external
https://nvd.nist.gov/vuln/detail/CVE-2015-5326	external
https://access.redhat.com/security/cve/CVE-2015-7537	self
https://bugzilla.redhat.com/show_bug.cgi?id=1291795	external
https://www.cve.org/CVERecord?id=CVE-2015-7537	external
https://nvd.nist.gov/vuln/detail/CVE-2015-7537	external
https://wiki.jenkins-ci.org/display/SECURITY/Jenk…	external
https://access.redhat.com/security/cve/CVE-2015-7538	self
https://bugzilla.redhat.com/show_bug.cgi?id=1291797	external
https://www.cve.org/CVERecord?id=CVE-2015-7538	external
https://nvd.nist.gov/vuln/detail/CVE-2015-7538	external
https://access.redhat.com/security/cve/CVE-2015-7539	self
https://bugzilla.redhat.com/show_bug.cgi?id=1291798	external
https://www.cve.org/CVERecord?id=CVE-2015-7539	external
https://nvd.nist.gov/vuln/detail/CVE-2015-7539	external
https://access.redhat.com/security/cve/CVE-2015-8103	self
https://bugzilla.redhat.com/show_bug.cgi?id=1282371	external
https://www.cve.org/CVERecord?id=CVE-2015-8103	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8103	external
https://access.redhat.com/security/cve/CVE-2016-1905	self
https://bugzilla.redhat.com/show_bug.cgi?id=1297910	external
https://www.cve.org/CVERecord?id=CVE-2016-1905	external
https://nvd.nist.gov/vuln/detail/CVE-2016-1905	external
https://access.redhat.com/security/cve/CVE-2016-1906	self
https://bugzilla.redhat.com/show_bug.cgi?id=1297916	external
https://www.cve.org/CVERecord?id=CVE-2016-1906	external
https://nvd.nist.gov/vuln/detail/CVE-2016-1906	external

Acknowledgments

Jenkins project

Daniel Beck

Jesse Glick

Stephen Connolly

Matthias Schmalz

Seth Graham

JSON

To clipboard

Loading 2.3 MB of JSON…

CVE-2014-3680 (GCVE-0-2014-3680)

Vulnerability from cvelistv5 – Published: 2014-10-16 19:00 – Updated: 2024-08-06 10:50

Summary

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

2 references

URL	Tags
https://access.redhat.com/errata/RHSA-2016:0070	vendor-advisoryx_refsource_REDHAT
https://wiki.jenkins-ci.org/display/SECURITY/Jenk…	x_refsource_CONFIRM

Date Public

2014-10-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:50:17.934Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2016:0070",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:0070"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized job by reading the DOM."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-06-09T16:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2016:0070",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:0070"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-3680",
    "datePublished": "2014-10-16T19:00:00.000Z",
    "dateReserved": "2014-05-14T00:00:00.000Z",
    "dateUpdated": "2024-08-06T10:50:17.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-3681 (GCVE-0-2014-3681)

Vulnerability from cvelistv5 – Published: 2014-10-15 14:00 – Updated: 2024-08-06 10:50

Summary

Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

4 references

URL	Tags
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
https://bugzilla.redhat.com/show_bug.cgi?id=1147766	x_refsource_MISC
https://access.redhat.com/errata/RHSA-2016:0070	vendor-advisoryx_refsource_REDHAT
https://wiki.jenkins-ci.org/display/SECURITY/Jenk…	x_refsource_CONFIRM

Date Public

2014-10-01 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:50:18.261Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "jenkins-cve20143681-xss(96975)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96975"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1147766"
          },
          {
            "name": "RHSA-2016:0070",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:0070"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "jenkins-cve20143681-xss(96975)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96975"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1147766"
        },
        {
          "name": "RHSA-2016:0070",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:0070"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-3681",
    "datePublished": "2014-10-15T14:00:00.000Z",
    "dateReserved": "2014-05-14T00:00:00.000Z",
    "dateUpdated": "2024-08-06T10:50:18.261Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-1806 (GCVE-0-2015-1806)

Vulnerability from cvelistv5 – Published: 2015-10-16 20:00 – Updated: 2024-08-06 04:54

Summary

The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

4 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1205620	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2016:0070	vendor-advisoryx_refsource_REDHAT
https://wiki.jenkins-ci.org/display/SECURITY/Jenk…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-1844.html	vendor-advisoryx_refsource_REDHAT

Date Public

2015-02-27 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:54:16.280Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205620"
          },
          {
            "name": "RHSA-2016:0070",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:0070"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
          },
          {
            "name": "RHSA-2015:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-02-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-06-09T16:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205620"
        },
        {
          "name": "RHSA-2016:0070",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:0070"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
        },
        {
          "name": "RHSA-2015:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-1806",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1205620",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205620"
            },
            {
              "name": "RHSA-2016:0070",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2016:0070"
            },
            {
              "name": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27",
              "refsource": "CONFIRM",
              "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
            },
            {
              "name": "RHSA-2015:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-1806",
    "datePublished": "2015-10-16T20:00:00.000Z",
    "dateReserved": "2015-02-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T04:54:16.280Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-1807 (GCVE-0-2015-1807)

Vulnerability from cvelistv5 – Published: 2015-10-16 20:00 – Updated: 2024-08-06 04:54

Summary

Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

4 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1205622	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2016:0070	vendor-advisoryx_refsource_REDHAT
https://wiki.jenkins-ci.org/display/SECURITY/Jenk…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-1844.html	vendor-advisoryx_refsource_REDHAT

Date Public

2015-02-27 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:54:16.383Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205622"
          },
          {
            "name": "RHSA-2016:0070",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:0070"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
          },
          {
            "name": "RHSA-2015:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-02-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-06-09T16:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205622"
        },
        {
          "name": "RHSA-2016:0070",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:0070"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
        },
        {
          "name": "RHSA-2015:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-1807",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1205622",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205622"
            },
            {
              "name": "RHSA-2016:0070",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2016:0070"
            },
            {
              "name": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27",
              "refsource": "CONFIRM",
              "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
            },
            {
              "name": "RHSA-2015:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-1807",
    "datePublished": "2015-10-16T20:00:00.000Z",
    "dateReserved": "2015-02-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T04:54:16.383Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-1808 (GCVE-0-2015-1808)

Vulnerability from cvelistv5 – Published: 2015-10-16 20:00 – Updated: 2024-08-06 04:54

Summary

Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

4 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1205623	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2016:0070	vendor-advisoryx_refsource_REDHAT
https://wiki.jenkins-ci.org/display/SECURITY/Jenk…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-1844.html	vendor-advisoryx_refsource_REDHAT

Date Public

2015-02-27 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:54:16.322Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205623"
          },
          {
            "name": "RHSA-2016:0070",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:0070"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
          },
          {
            "name": "RHSA-2015:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-02-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-06-09T16:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205623"
        },
        {
          "name": "RHSA-2016:0070",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:0070"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
        },
        {
          "name": "RHSA-2015:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-1808",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1205623",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205623"
            },
            {
              "name": "RHSA-2016:0070",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2016:0070"
            },
            {
              "name": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27",
              "refsource": "CONFIRM",
              "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
            },
            {
              "name": "RHSA-2015:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-1808",
    "datePublished": "2015-10-16T20:00:00.000Z",
    "dateReserved": "2015-02-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T04:54:16.322Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-1810 (GCVE-0-2015-1810)

Vulnerability from cvelistv5 – Published: 2015-10-16 20:00 – Updated: 2024-08-06 04:54

Summary

The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

4 references

URL	Tags
https://access.redhat.com/errata/RHSA-2016:0070	vendor-advisoryx_refsource_REDHAT
https://wiki.jenkins-ci.org/display/SECURITY/Jenk…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-1844.html	vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=1205627	x_refsource_CONFIRM

Date Public

2015-02-27 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:54:16.404Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2016:0070",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:0070"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
          },
          {
            "name": "RHSA-2015:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205627"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-02-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the \"Jenkins\u0027 own user database\" setting, which allows remote attackers to gain privileges by creating a reserved name."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-06-09T15:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2016:0070",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:0070"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
        },
        {
          "name": "RHSA-2015:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205627"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-1810",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the \"Jenkins\u0027 own user database\" setting, which allows remote attackers to gain privileges by creating a reserved name."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2016:0070",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2016:0070"
            },
            {
              "name": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27",
              "refsource": "CONFIRM",
              "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
            },
            {
              "name": "RHSA-2015:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1205627",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205627"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-1810",
    "datePublished": "2015-10-16T20:00:00.000Z",
    "dateReserved": "2015-02-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T04:54:16.404Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-1812 (GCVE-0-2015-1812)

Vulnerability from cvelistv5 – Published: 2015-10-16 20:00 – Updated: 2024-08-06 04:54

Summary

Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

4 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1205615	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2016:0070	vendor-advisoryx_refsource_REDHAT
https://wiki.jenkins-ci.org/display/SECURITY/Jenk…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-1844.html	vendor-advisoryx_refsource_REDHAT

Date Public

2015-03-23 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:54:16.387Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205615"
          },
          {
            "name": "RHSA-2016:0070",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:0070"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23"
          },
          {
            "name": "RHSA-2015:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-03-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-06-09T16:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205615"
        },
        {
          "name": "RHSA-2016:0070",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:0070"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23"
        },
        {
          "name": "RHSA-2015:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-1812",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1205615",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205615"
            },
            {
              "name": "RHSA-2016:0070",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2016:0070"
            },
            {
              "name": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23",
              "refsource": "CONFIRM",
              "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23"
            },
            {
              "name": "RHSA-2015:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-1812",
    "datePublished": "2015-10-16T20:00:00.000Z",
    "dateReserved": "2015-02-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T04:54:16.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-1813 (GCVE-0-2015-1813)

Vulnerability from cvelistv5 – Published: 2015-10-16 20:00 – Updated: 2024-08-06 04:54

Summary

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

4 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1205615	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2016:0070	vendor-advisoryx_refsource_REDHAT
https://wiki.jenkins-ci.org/display/SECURITY/Jenk…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-1844.html	vendor-advisoryx_refsource_REDHAT

Date Public

2015-03-23 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:54:16.273Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205615"
          },
          {
            "name": "RHSA-2016:0070",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:0070"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23"
          },
          {
            "name": "RHSA-2015:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-03-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1812."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-06-09T16:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205615"
        },
        {
          "name": "RHSA-2016:0070",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:0070"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23"
        },
        {
          "name": "RHSA-2015:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-1813",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1812."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1205615",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205615"
            },
            {
              "name": "RHSA-2016:0070",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2016:0070"
            },
            {
              "name": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23",
              "refsource": "CONFIRM",
              "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23"
            },
            {
              "name": "RHSA-2015:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-1813",
    "datePublished": "2015-10-16T20:00:00.000Z",
    "dateReserved": "2015-02-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T04:54:16.273Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-1814 (GCVE-0-2015-1814)

Vulnerability from cvelistv5 – Published: 2015-10-16 20:00 – Updated: 2024-08-06 04:54

Summary

The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

4 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1205616	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2016:0070	vendor-advisoryx_refsource_REDHAT
https://wiki.jenkins-ci.org/display/SECURITY/Jenk…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-1844.html	vendor-advisoryx_refsource_REDHAT

Date Public

2015-03-23 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:54:16.310Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205616"
          },
          {
            "name": "RHSA-2016:0070",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:0070"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23"
          },
          {
            "name": "RHSA-2015:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-03-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a \"forced API token change\" involving anonymous users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-06-09T16:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205616"
        },
        {
          "name": "RHSA-2016:0070",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:0070"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23"
        },
        {
          "name": "RHSA-2015:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-1814",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a \"forced API token change\" involving anonymous users."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1205616",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205616"
            },
            {
              "name": "RHSA-2016:0070",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2016:0070"
            },
            {
              "name": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23",
              "refsource": "CONFIRM",
              "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23"
            },
            {
              "name": "RHSA-2015:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-1814",
    "datePublished": "2015-10-16T20:00:00.000Z",
    "dateReserved": "2015-02-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T04:54:16.310Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-5317 (GCVE-0-2015-5317)

Vulnerability from cvelistv5 – Published: 2015-11-25 20:00 – Updated: 2025-10-21 23:55

Summary

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: active Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-07 13:39 UTC

CWE

n/a
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

redhat redhat root

References

4 references

URL	Tags
http://rhn.redhat.com/errata/RHSA-2016-0489.html	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2016:0070	vendor-advisoryx_refsource_REDHAT
https://wiki.jenkins-ci.org/display/SECURITY/Jenk…	x_refsource_CONFIRM
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Date Public

2015-11-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T06:41:09.278Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2016:0489",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html"
          },
          {
            "name": "RHSA-2016:0070",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:0070"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2015-5317",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-07T13:39:09.671765Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-05-12",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5317"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:55:56.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5317"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2023-05-12T00:00:00.000Z",
            "value": "CVE-2015-5317 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-11-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-06-09T16:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2016:0489",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html"
        },
        {
          "name": "RHSA-2016:0070",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:0070"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-5317",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2016:0489",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html"
            },
            {
              "name": "RHSA-2016:0070",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2016:0070"
            },
            {
              "name": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11",
              "refsource": "CONFIRM",
              "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-5317",
    "datePublished": "2015-11-25T20:00:00.000Z",
    "dateReserved": "2015-07-01T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:55:56.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2016:0070

CVE-2014-3680 (GCVE-0-2014-3680)

CVE-2014-3681 (GCVE-0-2014-3681)

CVE-2015-1806 (GCVE-0-2015-1806)

CVE-2015-1807 (GCVE-0-2015-1807)

CVE-2015-1808 (GCVE-0-2015-1808)

CVE-2015-1810 (GCVE-0-2015-1810)

CVE-2015-1812 (GCVE-0-2015-1812)

CVE-2015-1813 (GCVE-0-2015-1813)

CVE-2015-1814 (GCVE-0-2015-1814)

CVE-2015-5317 (GCVE-0-2015-5317)

Tags

Sightings

Nomenclature

Related by attack behaviour