2017

read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binut

dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validat

bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Bi

dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles point

LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a ma

LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handl

ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c.

ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadEnhMetaFile in coders/emf.c.

ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in PDFDelegateMessage in coders/pdf.c.

An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11.

An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100.

An Uncontrolled Search Path or Element issue was discovered in i-SENS SmartLog Diabetes Management Software, Version 2.4

An Improper Privilege Management issue was discovered in SpiderControl SCADA Web Server Version 2.02.0007 and prior. Aut

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7

[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated us

October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise

Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca

Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files

The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API ke

The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkin

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE

Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for reposito

The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persis

The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step t

Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, s

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for reposito

The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this pe

The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as pass

The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scri

The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vul

curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 by

When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTT

The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size su

On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in

Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instanc

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); Default

Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one th

Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request For

Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to

GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validat

Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact wit

The Sidebar Link plugin allows users able to configure jobs, views, and agents to add entries to the sidebar of these ob

GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one the

The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change i

Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list