Show filters
288 Total Results
Displaying 241-250 of 288
Sort by:
Attacker Value
Unknown
CVE-2015-8103
Disclosure Date: November 25, 2015 (last updated January 09, 2024)
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
0
Attacker Value
Unknown
CVE-2015-5318
Disclosure Date: November 25, 2015 (last updated October 05, 2023)
Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.
0
Attacker Value
Unknown
CVE-2015-5321
Disclosure Date: November 25, 2015 (last updated October 05, 2023)
The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages.
0
Attacker Value
Unknown
CVE-2015-5319
Disclosure Date: November 25, 2015 (last updated October 05, 2023)
XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an "XML-aware tool," as demonstrated by get-job and update-job.
0
Attacker Value
Unknown
CVE-2015-5325
Disclosure Date: November 25, 2015 (last updated October 05, 2023)
Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665.
0
Attacker Value
Unknown
CVE-2015-1812
Disclosure Date: October 16, 2015 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.
0
Attacker Value
Unknown
CVE-2015-1810
Disclosure Date: October 16, 2015 (last updated October 05, 2023)
The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.
0
Attacker Value
Unknown
CVE-2015-1806
Disclosure Date: October 16, 2015 (last updated October 05, 2023)
The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.
0
Attacker Value
Unknown
CVE-2015-1807
Disclosure Date: October 16, 2015 (last updated October 05, 2023)
Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts.
0
Attacker Value
Unknown
CVE-2015-1813
Disclosure Date: October 16, 2015 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1812.
0
