Jenkins
Jenkins Security Releases - October 2018
jenkins-2018-10 Oct 1, 2018 Source: Vendor
Jenkins security advisories for October 2018: 8 CVEs, 7 credited researchers.
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
8 lines
Showing 1–8 of 8
CVE-2018-1000406
BR2018-0000-041358
SECURITY-1074
unclaimed
Arbitrary file write vulnerability using file parameter definitions
Credited as Oleg Nenashev
CVE-2018-1000407
BR2018-0000-041359
SECURITY-1129
unclaimed
Reflected XSS vulnerability
Credited as Evan Grant of Tenable
CVE-2018-1000408
BR2018-0000-041360
SECURITY-1128
unclaimed
Ephemeral user record creation
Credited as Evan Grant of Tenable
CVE-2018-1000409
BR2018-0000-041361
SECURITY-1158
unclaimed
Session fixation vulnerability on user signup
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2018-1000410
BR2018-0000-041362
SECURITY-765
unclaimed
Failures to process form submission data could result in secrets being displayed or written to logs
Credited as Sam Gleske
CVE-2018-1000865
BR2018-0000-041363
SECURITY-1186
unclaimed
Sandbox Bypass in Script Security and Pipeline Groovy Plugins
Credited as Man Yue Mo of Semmle Security Research Team
CVE-2018-1000997
BR2018-0000-041364
SECURITY-867
unclaimed
Path traversal vulnerability in Stapler allowed accessing internal data
Credited as Apple Information Security
CVE-2018-1999043
BR2018-0000-041365
SECURITY-1162
unclaimed
Ephemeral user record was created on some invalid authentication attempts
Credited as Zhao Xiaojie