CVE-2016-3725

CVE-2016-3725 affects Jenkins before version 2.3 and Jenkins LTS before 1.651.2, due to a missing permissions check in Jenkins Core that allows remote authenticated users to trigger updating of update site metadata. This issue can be combined with DNS cache poisoning to cause a denial of service....

CVE-2022-3262

The CVE-2022-3262 entry concerns Red Hat OpenShift. A pod using DNSPolicy: ClusterFirst may resolve hostnames based on a provided service, enabling an attacker to supply an incorrect name via the DNS search policy. This impacts confidentiality and availability. The available documents identify th...

CVE-2022-3260

The CVE-2022-3260 issue is described across sources as an absence of the X-FRAME-OPTIONS header in responses, which can permit clickjacking attacks. The primary description notes that this header is not enabled and some browsers may misinterpret results, enabling clickjacking. The NVD entry assig...

CVE-2016-3723

CVE-2016-3723 affects Jenkins core/plugins: the advisory states that Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information due to missing permissions checks in unspecified XML/JSON API endpoints. The connect...

CVE-2016-3724

CVE-2016-3724 affects Jenkins before 2.3 and LTS before 1.651.2. The issue allows remote authenticated users with extended read access to extract sensitive password information by reading a job configuration. Root cause: exposed password data in job configuration accessible to users with read per...

CVE-2014-3681

CVE-2014-3681 is a cross-site scripting (XSS) vulnerability in Jenkins prior to 1.583 and in the LTS line prior to 1.565.3. The available sources describe that remote attackers can inject arbitrary web script or HTML via unspecified vectors, potentially affecting the Jenkins web interface. The co...

CVE-2016-3727

CVE-2016-3727 affects Jenkins (versions before 2.3 and before 1.651.2 LTS). The API URL /computer/(master)/api/xml allowed remote authenticated users with extended read permission on the master node to disclose sensitive global configuration information. This is demonstrated by a public PoC URL i...

CVE-2014-3661

CVE-2014-3661 affects Jenkins before 1.583 and LTS before 1.565.3 and causes a denial of service (thread consumption) through vectors related to a CLI handshake. The connected sources confirm this CVE entry and its description; no additional exploitation details are provided beyond the DoS impact...

CVE-2015-1812

CVE-2015-1812 corresponds to two cross-site scripting (XSS) flaws in Jenkins, allowing a remote attacker to conduct XSS against users of an application using Jenkins. Affected versions include Jenkins before 1.606 and LTS before 1.596.2; the provided sources describe the vulnerability generally a...

CVE-2015-5318

CVE-2015-5318 affects Jenkins core prior to 1.638 and LTS prior to 1.625.2. The vulnerability arises because a publicly accessible salt is used to generate CSRF protection tokens, making it easier for remote attackers to brute-force and bypass CSRF protection. The practical impact is the potentia...

CVE-2015-5321

CVE-2015-5321 affects Jenkins, enabling information disclosure via the sidepanel widgets in the CLI command overview and help pages. The root cause is an information leakage vulnerability exposed by direct requests to those pages, allowing remote attackers to obtain sensitive data. Affected versi...

CVE-2016-3726

CVE-2016-3726 corresponds to multiple open redirect vulnerabilities in Jenkins. Public details in connected sources specify that Jenkins versions prior to 2.3 and OpenShift/Jenkins LTS prior to 1.651.2 are affected via scheme-relative URLs that could redirect users to arbitrary sites, enabling ph...

CVE-2013-0196

OpenShift Enterprise 1.2 is affected by a CSRF vulnerability where the web console uses Basic authentication and the REST API lacks CSRF protection, potentially exposing credentials and Authorization headers when browsers request the API. Affected component: OpenShift Enterprise 1.2 web console/R...

CVE-2014-3662

CVE-2014-3662 affects Jenkins before 1.583 and LTS before 1.565.3. The vulnerability allows remote attackers to enumerate user names via login-related vectors. This is documented in multiple sources (e.g., GHSA/FIX2M entry and related OpenVAS entries). The connected documents confirm the affected...

CVE-2019-14845

CVE-2019-14845 affects OpenShift builds (OpenShift Container Platform) versions 4.1–4.3, where builds that extract source from a container image bypass TLS hostname verification, enabling a man-in-the-middle to inject content. Red Hat advisories RHSA-2019:4237 (OpenShift 4.1.28) and RHSA-2019:410...

CVE-2020-1709

Summary (CVE-2020-1709): A privilege-escalation vulnerability in the Red Hat OpenShift/OpenShift MediaWiki container stack affects all OpenShift MediaWiki 4.x versions prior to 4.3.0. The root cause is an insecure modification vulnerability in /etc/passwd within the openshift/mediawiki container,...

CVE-2016-1000229

Swagger-UI CVE-2016-1000229: Cross-site scripting via key names in the JSON document. Root cause: improper validation of user-supplied input in Swagger UI. Impact: remote attacker could execute script in a victim’s browser within the hosting site’s security context. Remediation (per Red Hat IBM a...

CVE-2014-3666

CVE-2014-3666 affects Jenkins and Jenkins Enterprise via the CLI channel. The vulnerability allows remote code execution when handling a crafted packet sent over the CLI, applicable to Jenkins before 1.583 and LTS before 1.565.3. The NVD entry cites a base score of 7.5 (HIGH) with network attack ...

CVE-2015-1807

CVE-2015-1807 affects Jenkins (CloudBees Jenkins CI and Jenkins core) prior to 1.600 and LTS prior to 1.596.1. The issue is a directory traversal vulnerability: during artifact handling, Jenkins could follow a symlink, enabling a remote authenticated user with certain permissions to read arbitrar...

CVE-2015-1806

The CVE-2015-1806 issue affects Jenkins versions before 1.600 and LTS before 1.596.1, where a combination filter Groovy script could allow remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors. This is docu...

CVE-2015-1810

CVE-2015-1810 affects Jenkins/CloudBees Jenkins CI prior to 1.600 and LTS prior to 1.596.1. The HudsonPrivateSecurityRealm class does not restrict access to reserved names when using the Jenkins’ own user database, enabling a remote attacker to gain privileges by creating a reserved name. The iss...

CVE-2015-5322

CVE-2015-5322 affects Jenkins: vulnerable in versions before 1.638 and LTS before 1.625.2; directory traversal via requests to jnlpJars/ can list/read arbitrary Jenkins servlet resources. Mitigation: upgrade to 1.638+ or the corresponding LTS (1.625.2+).

CVE-2015-5326

CVE-2015-5326 is a Jenkins XSS vulnerability affecting the slave overview page. It affects Jenkins core prior to 1.638 and LTS prior to 1.625.2, allowing remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message. The issue aris...

CVE-2015-7528

CVE-2015-7528 affects Kubernetes prior to 1.2.0-alpha.5, where the API/back end could be leveraged to read arbitrary pod logs by specifying a container name. The root cause is insufficient verification of log-location requests, enabling a remote attacker to access pod logs that should be restrict...

CVE-2012-5658

OpenShift Origin before 1.1 is vulnerable: when running rhc-chk.rb with -d (debug mode), it writes passwords and other sensitive information in cleartext (e.g., in logs or support channels). The root cause is that the rhc-chk output is not redacted in debug mode. Red Hat’s RHSA-2013-0220 confirms...

CVE-2014-3664

CVE-2014-3664 : Jenkins prior to 1.583 and LTS prior to 1.565.3 is affected by a directory traversal vulnerability that allows remote authenticated users with Overall/READ to read arbitrary files via unspecified vectors. The issue is caused by an insecure handling of file paths, enabling access t...

CVE-2015-1813

CVE-2015-1813 is a Jenkins/Jenkins Core cross-site scripting (XSS) vulnerability. Public details from connected documents indicate Jenkins prior to 1.606 and LTS prior to 1.596.2 are vulnerable to remote XSS via unspecified vectors. The CNVD entry explicitly names CloudBees Jenkins CI and LTS, no...

CVE-2015-1814

CVE-2015-1814 affects Jenkins Core/API token-issuing service. The vulnerability allows remote privilege escalation via the forced API token change, occurring due to insufficient protection for anonymous users. Affected versions are Jenkins before 1.606 and LTS before 1.596.2. The issue is mitigat...

CVE-2017-2611

CVE-2017-2611 affects Jenkins before 2.44 and 2.32.2. The issue is an insufficient permission check for periodic processes: the /workspaceCleanup and /fingerprintCleanup URLs did not enforce permissions, allowing users with read access to trigger these daily background tasks. This could lead to u...

CVE-2019-19335

CVE-2019-19335 affects OpenShift 4.2 installer (ose-installer). During cluster installation, openshift-install creates an auth directory containing kubeconfig and kubeadmin-password, which are incorrectly world-readable, exposing API credentials. Multiple sources (NVD, OSV, Red Hat advisories) co...

CVE-2013-4253

The CVE-2013-4253 entry relates to Red Hat OpenShift 1’s OpenShift Extras deployment script, where the script installs a default public key into the root user’s authorized_keys file. This is the concrete vulnerability detail present in the connected Red Hat advisory and NVD entries. The descripti...

CVE-2014-3667

CVE-2014-3667 affects Jenkins versions: before 1.583 and LTS before 1.565.3. The issue allows an information disclosure where remote authenticated users with the Overall/READ permission can read plugin code by downloading plugins. This is supported by multiple sources (NVD entry and GHSA advisory...

CVE-2019-10225

CVE-2019-10225 relates to a flaw in atomic-openshift (OpenShift 4.2) where the basic-user RBAC role does not sufficiently protect the GlusterFS StorageClass against leaking the restuserkey. An attacker with basic-user privileges could obtain the restuserkey and authenticate to the GlusterFS REST ...

CVE-2015-5320

CVE-2015-5320 affects Jenkins and its JNLP slave mechanism. The vulnerability arises from improper verification of the shared secret used in JNLP slave connections, allowing remote attackers to connect as slaves and potentially access sensitive information or gain administrative privileges by kno...

CVE-2015-7539

CVE-2015-7539 affects Jenkins: Plugins Manager in Jenkins (non-LTS prior to 1.640 and LTS prior to 1.625.2) does not verify checksums for plugin files referenced in update site data, enabling potential MITM exploitation to run arbitrary code via a crafted plugin. Remediation: upgrade Jenkins to 1...

CVE-2021-4047

CVE-2021-4047 notes that OpenShift 4.9.6 patching omitted CVE-2021-39242 for haproxy. Public sources confirm CVE-2021-39242 is a haproxy HTTP Host header mismatch issue (affecting versions prior to 2.2.16/2.3.13/2.4.3) with potential security bypass implications; IBM Red Hat/Amazon/Linux advisori...

CVE-2013-7370

CVE-2013-7370 concerns node-connect before 2.8.1, which has an XSS vulnerability in the Sencha Labs Connect middleware. Affected component: node-connect (Sencha Connect middleware). Root cause/impact: XSS in the middleware could reflect or inject script via user input; exploitation status is not ...

CVE-2015-5324

Jenkins vulnerability CVE-2015-5324 affects Jenkins core prior to 1.638 and LTS prior to 1.625.2, enabling remote attackers to disclose sensitive information by directly requesting /queue/api. The issue is an information-disclosure flaw in the queue API handling, not a code-execution vector. Affe...

CVE-2015-7538

CVE-2015-7538 affects Jenkins prior to 1.640 and OpenJenkins LTS prior to 1.625.2. The issue allows remote attackers to bypass the CSRF protection mechanism via unspecified vectors, enabling bypass of CSRF controls and enabling potentially unauthorized actions on behalf of an authenticated user. ...

CVE-2014-0175

CVE-2014-0175 relates to mcollective with a default password set at installation. Connected sources corroborate an unpatched/default-credential condition affecting mcollective; CVSS metrics indicate high risk (Network, low attack complexity, no authentication required, partial confidentiality/int...

CVE-2014-3496

CVE-2014-3496 affects rubygem-openshift-origin-node in Red Hat OpenShift/OpenShift Origin. A command-injection flaw in cartridge_repository.rb allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with .tar.gz, .zip, .tgz, or .tar in a cartridge man...

CVE-2012-6135

CVE-2012-6135 affects Phusion Passenger RubyGem (RubyGems passenger) versions 4.0.0 beta1/beta2. The startup routine can be abused to delete arbitrary files. Exploitation context varies by source: NVD/SUSE/GHSA imply remote access, while the RubySec advisory notes a local attacker during startup....

CVE-2014-3663

CVE-2014-3663 affects Jenkins before 1.583 and LTS before 1.565.3. Remote authenticated users with the Job/CONFIGURE permission can bypass restrictions to create or destroy arbitrary jobs via unspecified vectors. The vulnerability is documented in the NVD entry for CVE-2014-3663 and reflected in ...

CVE-2017-15137

CVE-2017-15137 affects OpenShift: the image import whitelist failed to enforce restrictions when executing commands like oc tag, potentially allowing restricted registries to be used. Root cause: whitelist enforcement flaw. Impact: open to running non-permitted images. Remediation: Red Hat adviso...

CVE-2013-0164

Affected product: Red Hat OpenShift Origin before 1.1. The CVE-2013-0164 issue resides in the lockwrap function of port-proxy/bin/openshift-port-proxy-cfg, which creates a temporary file in /tmp insecurely. This allows local users to overwrite arbitrary files via a symlink attack on a predictable...

CVE-2015-7537

CVE-2015-7537 affects Jenkins, described as a CSRF vulnerability that could allow an attacker to hijack admin authentication via HTTP GET. Affected versions: Jenkins before 1.640 and LTS before 1.625.2. Mitigation: upgrade to Jenkins 1.640 or newer or LTS 1.625.2 or newer. The connected advisory ...

CVE-2015-5325

CVE-2015-5325 affects Jenkins before 1.638 and OpenJenkins LTS before 1.625.2, where a JNLP slave can bypass intended slave-to-master access restrictions. This vulnerability stems from an incomplete fix for CVE-2014-3665. Remediation: upgrade to Jenkins 1.638 or newer, or to LTS 1.625.2 or newer,...

CVE-2014-1869

The CVE-2014-1869 entry covers multiple XSS vulnerabilities in ZeroClipboard.swf (ZeroClipboard before 1.3.2) used by Jenkins. The underlying issue is reflective/scriptable XSS through SWF query parameters (loaderInfo.parameters), enabling remote attackers to inject arbitrary script/HTML. Documen...

CVE-2015-5305

CVE-2015-5305 describes a directory traversal in Kubernetes as used by Red Hat OpenShift Enterprise 3.0. An attacker can write to arbitrary files by supplying a crafted object type name that is not properly validated before being passed to etcd. The vulnerability affects Kubernetes/OpenShift comp...

CVE-2015-5323

CVE-2015-5323 affects Jenkins: versions before 1.638 and the LTS line prior to 1.625.2 do not properly restrict access to API tokens, which could allow a remote administrator to gain privileges and run scripts using another user’s API token. Mitigation is to upgrade to Jenkins 1.638 or later, and...