CVE-2019-10402

In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents...

CVE-2019-10403

CVE-2019-10403 affects Jenkins 2.196 and earlier, and LTS 2.176.3 and earlier. The vulnerability is a stored XSS in the tooltip for SCM tag actions caused by not escaping the SCM tag name, allowing an authenticated user who can control SCM tag names to execute arbitrary script in a victim’s brows...

CVE-2019-10404

CVE-2019-10404 affects Jenkins core prior to 2.196 (and LTS prior to 2.176.3) where the reason text shown in queue item tooltips isn’t escaped, leading to stored XSS when an actor can influence parts of the blocked-queue reason (e.g., label expressions). Affected versions: Jenkins 2.196 and earli...

CVE-2019-10402

CVE-2019-10402 affects Jenkins up to version 2.196 and earlier, and LTS up to 2.176.3 and earlier. The f:combobox form control interprets item labels as HTML, causing a stored XSS vulnerability exploitable by users with permission to define its contents. Reported in related advisories (e.g., Jenk...

CVE-2019-10402

In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents...

CVE-2019-10405

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly...

CVE-2019-10401

In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents typically Job/Configure...

PT-2019-11799 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.196 and earlier, LTS versions 2.176.3 and earlier Description: The issue allows attackers to obtain the HTTP session cookie, despite it being marked HttpOnly, by exploiting another XSS vulnerability and accessing the /whoAm...

[SECURITY] [DLA 1927-1] qemu security update

Package : qemu Version : 1:2.1+dfsg-12+deb8u12 CVE ID : CVE-2016-5126 CVE-2016-5403 CVE-2017-9375 CVE-2019-12068 CVE-2019-12155 CVE-2019-13164 CVE-2019-14378 CVE-2019-15890 Debian Bug : 826151 832619 864219 929353 931351 933741 933742 939868 939869 Several vulnerabilities were found in QEMU, a fa...

Ubuntu 18.04 LTS : Tomcat vulnerabilities (USN-4128-2)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4128-2 advisory. It was discovered that the Tomcat 9 SSI printenv command echoed user provided data without escaping it. An attacker could possibly use this issue to...

[SECURITY] [DLA 1922-1] wpa security update

Package : wpa Version : 2.3-1+deb8u9 CVE ID : CVE-2019-16275 Debian Bug : 940080 hostapd and wpasupplicant when controlling AP mode did not perform sufficient source address validation for some received Management frames and this could result in ending up sending a frame that caused associated...

Ubuntu 18.04 LTS : WebKitGTK+ vulnerabilities (USN-4130-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4130-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, ...

[SECURITY] [DLA 1916-1] opensc security update

Package : opensc Version : 0.16.0-3+deb8u1 CVE ID : CVE-2018-16391 CVE-2018-16392 CVE-2018-16393 CVE-2018-16418 CVE-2018-16419 CVE-2018-16420 CVE-2018-16421 CVE-2018-16422 CVE-2018-16423 CVE-2018-16424 CVE-2018-16425 CVE-2018-16426 CVE-2018-16427 CVE-2019-15945 CVE-2019-15946 Debian Bug : 909444...

Ubuntu 18.04 LTS : systemd regression (USN-4120-2)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4120-2 advisory. USN-4120-1 fixed a vulnerability in systemd. The update included a recent SRU from the updates pocket that introduced networking problems for some users. This...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel regression (USN-4115-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4115-2 advisory. USN 4115-1 fixed vulnerabilities in the Linux 4.15 kernel for Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. Unfortunately, as part of the update, a regressio...

Ubuntu 16.04 LTS / 18.04 LTS : Tomcat vulnerabilities (USN-4128-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4128-1 advisory. It was discovered that the Tomcat 8 SSI printenv command echoed user provided data without escaping it. An attacker could possibly use this...

Ubuntu 16.04 LTS : FreeType vulnerability (USN-4126-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4126-1 advisory. It was discovered that FreeType incorrectly handled certain font files. An attacker could possibly use this issue to access sensitive information. Tenable has...

[SECURITY] [DLA 1914-1] icedtea-web security update

Package : icedtea-web Version : 1.5.3-1+deb8u1 CVE ID : CVE-2019-10181 CVE-2019-10182 CVE-2019-10185 Debian Bug : 934319 Several security vulnerabilities were found in icedtea-web, an implementation of the Java Network Launching Protocol JNLP. CVE-2019-10181 It was found that in icedtea-web...

Ubuntu 16.04 LTS / 18.04 LTS : Exim vulnerability (USN-4124-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4124-1 advisory. It was discovered that Exim incorrectly handled certain decoding operations. A remote attacker could possibly use this issue to execute arbitrary...

Ubuntu 18.04 LTS : npm/fstream vulnerability (USN-4123-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4123-1 advisory. It was discovered that npm/fstream incorrectly handled certain crafted tarballs. An attacker could use this vulnerability to write aritrary files to the filesyste...