The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 03 23 | — | Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 1.596.2Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 1.606 | Nov 13, 2017 | Oct 16, 2015 |
| Redhat Openshift | — | Upgrade nodejs-es6-promiseUpgrade nodejs-filename-regexUpgrade nodejs-arrifyUpgrade nodejs-glob-baseUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-ansi-wrapUpgrade rubygem-openshift-origin-msg-broker-mcollectiveUpgrade nodejs-micromatchUpgrade rubygem-openshift-origin-gear-placementUpgrade nodejs-parse-jsonUpgrade nodejs-write-file-atomicUpgrade nodejs-mkdirpUpgrade jenkinsUpgrade nodejs-is-redirectUpgrade openshift-origin-cartridge-diyUpgrade nodejs-readdirpUpgrade nodejs-semverUpgrade openshift-ansibleUpgrade nodejs-pinkieUpgrade nodejs-is-equal-shallowUpgrade nodejs-undefsafeUpgrade nodejs-repeat-elementUpgrade openvswitchUpgrade nodejs-fill-rangeUpgrade nodejs-lowercase-keysUpgrade nodejs-iniUpgrade nodejs-rcUpgrade origin-kibanaUpgrade nodejs-lodash.defaultsUpgrade nodejs-configstoreUpgrade rubygem-openshift-origin-routing-daemonUpgrade nss_wrapperUpgrade nodejs-object.omitUpgrade nodejs-is-extendableUpgrade nodejs-lodash.getnativeUpgrade nodejs-kind-ofUpgrade nodejs-lodash.createassignerUpgrade nodejs-is-dotfileUpgrade nodejs-create-error-classUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-regex-cacheUpgrade nodejs-object-assignUpgrade nodejs-arr-diffUpgrade rhcUpgrade nodejs-osenvUpgrade openshift-origin-logshifterUpgrade nodejs-lodash.assignUpgrade nodejs-chokidarUpgrade openshift-origin-cartridge-haproxyUpgrade openshift-origin-cartridge-jbosseapUpgrade nodejs-pause-streamUpgrade nodejs-latest-versionUpgrade nodejs-read-all-streamUpgrade openshift-origin-cartridge-rubyUpgrade openshift-origin-cartridge-jbossewsUpgrade nodejs-url-parse-laxUpgrade nodejs-async-eachUpgrade openshift-origin-cartridge-mockUpgrade nodejs-preserveUpgrade nodejs-strip-json-commentsUpgrade nodejs-graceful-fsUpgrade nodejs-timed-outUpgrade nodejs-package-jsonUpgrade nodejs-extglobUpgrade nodejs-is-extglobUpgrade atomic-openshiftUpgrade nodejs-anymatchUpgrade nodejs-duplexifyUpgrade nodejs-registry-urlUpgrade nodejs-for-inUpgrade openshift-origin-cartridge-perlUpgrade nodejs-slideUpgrade nodejs-randomaticUpgrade nodejs-unzip-responseUpgrade nodejs-capture-stack-traceUpgrade nodejs-lodash.baseassignUpgrade nodejs-ansi-greenUpgrade nodejs-is-binary-pathUpgrade heapsterUpgrade nodejs-throughUpgrade openshift-origin-node-utilUpgrade nodejs-prepend-httpUpgrade nodejs-is-streamUpgrade nodejs-glob-parentUpgrade nodejs-lodash.isarrayUpgrade nodejs-lodash.restparamUpgrade nodejs-nodemonUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-is-npmUpgrade nodejs-is-globUpgrade nodejs-expand-rangeUpgrade openshift-origin-broker-utilUpgrade nodejs-is-primitiveUpgrade nodejs-for-ownUpgrade nodejs-normalize-pathUpgrade nodejs-fromUpgrade nodejs-update-notifierUpgrade nodejs-error-exUpgrade nodejs-map-streamUpgrade nodejs-node-status-codesUpgrade nodejs-is-numberUpgrade nodejs-lodash.keysUpgrade nodejs-align-textUpgrade nodejs-os-tmpdirUpgrade nodejs-duplexerUpgrade nodejs-array-uniqueUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-success-symbolUpgrade openshift-origin-cartridge-phpUpgrade nodejs-os-homedirUpgrade openshift-origin-brokerUpgrade openshift-origin-cartridge-jenkinsUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-binary-extensionsUpgrade nodejs-stream-combinerUpgrade nodejs-bracesUpgrade nodejs-event-streamUpgrade nodejs-parse-globUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-string-lengthUpgrade nodejs-ps-treeUpgrade nodejs-lazy-cacheUpgrade nodejs-splitUpgrade nodejs-pinkie-promiseUpgrade nodejs-xdg-basedirUpgrade nodejs-lodash.basecopyUpgrade nodejs-lodash.isargumentsUpgrade nodejs-expand-bracketsUpgrade nodejs-arr-flattenUpgrade nodejs-isobjectUpgrade nodejs-gotUpgrade nodejs-optimistUpgrade nodejs-deep-extendUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-semver-diffUpgrade nodejs-end-of-streamUpgrade nodejs-touchUpgrade nodejs-is-plain-objUpgrade openshift-origin-cartridge-nodejsUpgrade nodejs-uuid | Jun 18, 2018 | Mar 23, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub