Security Vulnerabilities - CVEs Published In September 2019
An issue was discovered in the portaudio-rs crate through 0.3.1 for Rust. There is a use-after-free with resultant arbitrary code execution because of a lack of unwind safety in stream_callback and stream_finished_callback.
CVSS Score
9.8
EPSS Score
0.012
Published
2019-09-25
An issue was discovered in the string-interner crate before 0.7.1 for Rust. It allows attackers to read from memory locations associated with dangling pointers, because of a cloning flaw.
CVSS Score
7.5
EPSS Score
0.003
Published
2019-09-25
Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVSS Score
5.3
EPSS Score
0.0
Published
2019-09-25
Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVSS Score
7.5
EPSS Score
0.001
Published
2019-09-25
Jenkins GitLab Logo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS Score
5.5
EPSS Score
0.0
Published
2019-09-25
Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
CVSS Score
5.5
EPSS Score
0.0
Published
2019-09-25
SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php.
CVSS Score
9.8
EPSS Score
0.002
Published
2019-09-25
pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value.
CVSS Score
8.8
EPSS Score
0.205
Published
2019-09-25
Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by users able to define log parsing rules.
CVSS Score
5.4
EPSS Score
0.001
Published
2019-09-25
Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVSS Score
7.5
EPSS Score
0.001
Published
2019-09-25