Jenkins
Jenkins Security Releases - May 2018
jenkins-2018-05 May 1, 2018 Source: Vendor
Jenkins security advisories for May 2018: 7 CVEs, 8 credited researchers.
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
8 lines
Showing 1–8 of 8
CVE-2018-1000192
BR2018-0000-041289
SECURITY-771
unclaimed
CLI and UI allow non-admin users to enumerate installed plugins
Credited as Devin Nusbaum, CloudBees, Inc.
CVE-2018-1000193
BR2018-0000-041290
SECURITY-786
unclaimed
Users were able to register user names containing control characters
Credited as Sureshbabu Narvaneni
CVE-2018-1000194
BR2018-0000-041291
SECURITY-788
unclaimed
Path traversal vulnerability in agent to controller security subsystem
Credited as Kalle Niemitalo, Procomp Solutions Oy
CVE-2018-1000194
BR2018-0000-041292
SECURITY-788
unclaimed
Path traversal vulnerability in agent to controller security subsystem
Credited as Jesse Glick, CloudBees, Inc.
CVE-2018-1000195
BR2018-0000-041293
SECURITY-794
unclaimed
Users with Overall/Read permission were able to send GET requests to any URL
Credited as Thomas de Grenier de Latour
CVE-2018-1000196
BR2018-0000-041294
SECURITY-263
unclaimed
Gitlab Hook Plugin stores and displays GitLab API token in plain text
Credited as Steve Marlowe of Cisco ASIG
CVE-2018-1000197
BR2018-0000-041295
SECURITY-670
unclaimed
Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000198
BR2018-0000-041296
SECURITY-671
unclaimed
XML External Entity processing vulnerability in Black Duck Hub Plugin
Credited as James Nord, CloudBees, Inc.