CVEs published November 25, 2015
19 CVEs were published on November 25, 2015: 0 critical, 1 high. 1 is now in CISA KEV.
- Published
- 19
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 18
- Now in CISA KEV
- 1
- Fix available
- 13
Most affected products
- org.jenkins-ci.main:jenkins-core
- 11
- org.jenkins-ci.main:cli
- 1
- python-ironic-inspector-client · ironic-inspector
- 1
High 1
Medium, low and unrated 18
- CVE-2014-3665Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote atorg.jenkins-ci.main:jenkins-core
- CVE-2015-5242OpenStack Swift-on-File (aka Swiftonfile) does not properly restrict use of the pickle Python module when loading metadata, which allows rem
- CVE-2015-5306OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access thpython-ironic-inspector-client · ironic-inspector
- CVE-2015-5318Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for reorg.jenkins-ci.main:jenkins-core
- CVE-2015-5319XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackersorg.jenkins-ci.main:jenkins-core
- CVE-2015-5320Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attorg.jenkins-ci.main:jenkins-core
- CVE-2015-5321The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to oborg.jenkins-ci.main:jenkins-core
- CVE-2015-5322Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and readorg.jenkins-ci.main:jenkins-core
- CVE-2015-5323Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain prorg.jenkins-ci.main:jenkins-core
- CVE-2015-5324Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.org.jenkins-ci.main:jenkins-core
- CVE-2015-5325Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slavorg.jenkins-ci.main:jenkins-core
- CVE-2015-5326Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticatorg.jenkins-ci.main:jenkins-core
- CVE-2015-8103The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serorg.jenkins-ci.main:cli
- CVE-2015-6379The XML parser in the management interface in Cisco Adaptive Security Appliance (ASA) Software 8.4 allows remote authenticated users to caus
- CVE-2015-7285CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 do not require authentication from Alarm Receiving Center (ARC) servers, w
- CVE-2015-7286CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 rely on a polyalphabetic substitution cipher with hardcoded keys, which ma
- CVE-2015-7287CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 use the same 001984 default PIN across different customers' installations,
- CVE-2015-7288CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 allow remote attackers to modify the configuration via a command in an SMS