CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache HugeGraph-Server Remote Command Execution (RCE) Vulnerability Advisory (CVE-2024-27348)
[Affected Scope] Apache HugeGraph-Server versions from 1.0.0 before 1.3.0 running on Java 8 & Java 11
[Impact] Unauthenticated remote attackers can bypass security controls and execute arbitrary system commands via the Gremlin query engine, leading to full system compromise
[Mitigation] Upgrade Apache HugeGraph-Server to version 1.3.0 or higher with Java 11, and ensure the Authentication system is enabled
Jenkins Pipeline: Groovy Plugin Sandbox Bypass Remote Code Execution (CVE-2019-1003030)
[Affected Scope] Jenkins Pipeline: Groovy Plugin 2.63 and earlier
[Impact] Attackers with pipeline script control can bypass the Groovy sandbox to execute arbitrary code on the Jenkins master JVM
[Mitigation] Immediately upgrade Jenkins Pipeline: Groovy Plugin to version 2.64 or later
Jenkins Script Security Plugin Sandbox Bypass Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2019-1003029)
[Affected Scope] Jenkins Script Security Plugin 1.53 and earlier
[Impact] Attackers with Overall/Read permission can bypass the Groovy sandbox to execute arbitrary code on the Jenkins master JVM
[Mitigation] Immediately update the Script Security Plugin to version 1.54 or later, and restrict unnecessary user permissions
Oracle Java SE and OpenJDK JMX Component Sandbox Bypass Vulnerability (CVE-2013-0431)
[Affected Scope] Oracle Java SE 7 through Update 11, and OpenJDK 7.
[Impact] Remote attackers can bypass the Java security sandbox and execute arbitrary code with elevated privileges.
[Mitigation] Apply the latest Java SE/OpenJDK security updates and disable Java browser plugins immediately.