Vulnerabilities > Oracle > Communications Cloud Native Core Automated Test Suite

DATE CVE VULNERABILITY TITLE RISK
2021-01-14 CVE-2021-22132 Insufficiently Protected Credentials vulnerability in multiple products
Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API.
network
high complexity
elastic oracle CWE-522
4.8
2019-11-08 CVE-2019-10219 A vulnerability was found in Hibernate-Validator.
network
low complexity
redhat netapp oracle
6.1
2019-08-28 CVE-2019-10384 Cross-Site Request Forgery (CSRF) vulnerability in multiple products
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
network
low complexity
jenkins oracle redhat CWE-352
8.8
2019-08-28 CVE-2019-10383 Cross-site Scripting vulnerability in multiple products
A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.
network
low complexity
jenkins oracle redhat CWE-79
4.8
2019-04-10 CVE-2019-1003050 Cross-site Scripting vulnerability in multiple products
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.
network
low complexity
jenkins oracle redhat CWE-79
5.4
2019-04-10 CVE-2019-1003049 Insufficient Session Expiration vulnerability in multiple products
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.
network
high complexity
jenkins redhat oracle CWE-613
8.1
2018-07-23 CVE-2018-1999007 Cross-site Scripting vulnerability in multiple products
A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins to define JavaScript that would be executed in another user's browser when that other user views HTTP 404 error pages while Stapler debug mode is enabled.
network
low complexity
jenkins oracle CWE-79
5.4
2018-07-23 CVE-2018-1999005 Cross-site Scripting vulnerability in multiple products
A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidget/control.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
network
low complexity
jenkins oracle CWE-79
5.4
2018-07-23 CVE-2018-1999004 Incorrect Authorization vulnerability in multiple products
A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches.
network
low complexity
jenkins oracle CWE-863
4.3
2018-07-23 CVE-2018-1999003 Incorrect Authorization vulnerability in multiple products
A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permission to cancel queued builds.
network
low complexity
jenkins oracle CWE-863
4.3