CC
Product
Communications Cloud Native Core Automated Test Suite
On CISA KEVExploited in the wild
50
CVEs
4
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 22Medium 24Low 0
Watch
Add Communications Cloud Native Core Automated Test Suite to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-22965 In wildKEV | 9.8 | Apr 1 | Spring Framework JDK 9+ Remote Code Execution Vulnerability Affected: 1.9.0; 22.1.0 |
| CVE-2022-22963 In wildKEV | 9.8 | Apr 1 | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability Affected: 1.9.0; 22.1.0 |
| CVE-2017-1000353 In wildKEV | 9.8 | Jan 29 | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution Affected: 1.9.0 |
| CVE-2021-39144 In wildKEV | 8.5 | Aug 23 | XStream is vulnerable to a Remote Command Execution attack Affected: 1.9.0 |
| CVE-2021-29921 | 9.8 | May 6 | In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string Affected: 1.8.0 |
| CVE-2021-39139 | 8.8 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 1.9.0 |
| CVE-2019-10384 | 8.8 | Aug 28 | Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could… Affected: 1.9.0 |
| CVE-2018-1999001 | 8.8 | Jul 23 | A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allows attackers to provide crafted login… Affected: 1.9.0 |
| CVE-2021-39150 | 8.5 | Aug 23 | A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling Affected: 1.9.0 |
| CVE-2021-39152 | 8.5 | Aug 23 | A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling Affected: 1.9.0 |
| CVE-2021-39149 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 1.9.0 |
| CVE-2021-39148 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 1.9.0 |
| CVE-2021-39147 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 1.9.0 |
| CVE-2021-39146 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 1.9.0 |
| CVE-2021-39145 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 1.9.0 |
| CVE-2021-39141 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 1.9.0 |
| CVE-2021-39153 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 1.9.0 |
| CVE-2021-39151 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 1.9.0 |
| CVE-2021-39154 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 1.9.0 |
| CVE-2019-1003049 | 8.1 | Apr 10 | Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins… Affected: 1.9.0 |
| CVE-2018-1000194 | 8.1 | Jun 5 | A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write… Affected: 1.9.0 |
| CVE-2021-43859 | 7.5 | Feb 1 | XStream is an open source java library to serialize objects to XML and back again Affected: 1.9.0 |
| CVE-2021-35516 | 7.5 | Jul 13 | When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs Affected: 1.8.0 |
| CVE-2021-35515 | 7.5 | Jul 13 | When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop Affected: 1.8.0 |
| CVE-2021-36090 | 7.5 | Jul 13 | Apache Commons Compress 1.0 to 1.20 denial of service vulnerability Affected: 1.8.0 |
| CVE-2018-1999002 | 7.5 | Jul 23 | A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers… Affected: 1.9.0 |
| CVE-2021-22144 | 6.5 | Jul 26 | In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok… Affected: 1.8.0 |
| CVE-2021-22145 | 6.5 | Jul 21 | A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting Affected: 1.8.0 |
| CVE-2018-6356 | 6.5 | Feb 20 | Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files Affected: 1.9.0 |
| CVE-2021-39140 | 6.3 | Aug 23 | XStream can cause a Denial of Service Affected: 1.9.0 |
| CVE-2019-10219 | 6.1 | Nov 8 | A vulnerability was found in Hibernate-Validator Affected: 1.8.0 |
| CVE-2021-36374 | 5.5 | Jul 14 | When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even… Affected: 1.9.0 |
| CVE-2021-36373 | 5.5 | Jul 14 | When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small… Affected: 1.9.0 |
| CVE-2022-20615 | 5.4 | Jan 12 | Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting… Affected: 1.9.0 |
| CVE-2019-1003050 | 5.4 | Apr 10 | The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site… Affected: 1.9.0 |
| CVE-2018-1999007 | 5.4 | Jul 23 | A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers… Affected: 1.9.0 |
| CVE-2018-1999005 | 5.4 | Jul 23 | A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidget/control.jelly that allows attackers… Affected: 1.9.0 |
| CVE-2018-1000068 | 5.3 | Feb 16 | An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the… Affected: 1.9.0 |
| CVE-2018-1000067 | 5.3 | Feb 16 | An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests… Affected: 1.9.0 |
| CVE-2021-22132 | 4.8 | Jan 14 | Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API Affected: 1.8.0 |
| CVE-2019-10383 | 4.8 | Aug 28 | A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site… Affected: 1.9.0 |
| CVE-2022-20614 | 4.3 | Jan 12 | A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to… Affected: 1.9.0 |
| CVE-2022-20613 | 4.3 | Jan 12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS used by the Jenkins instance to resolve… Affected: 1.9.0 |
| CVE-2022-20612 | 4.3 | Jan 12 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no… Affected: 1.9.0 |
| CVE-2021-22134 | 4.3 | Mar 8 | A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used Affected: 1.8.0 |
| CVE-2018-1999004 | 4.3 | Jul 23 | A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to… Affected: 1.9.0 |
| CVE-2018-1999003 | 4.3 | Jul 23 | A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permission to cancel queued… Affected: 1.9.0 |
| CVE-2018-1000195 | 4.3 | Jun 5 | A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission… Affected: 1.9.0 |
| CVE-2018-1000193 | 4.3 | Jun 5 | A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign… Affected: 1.9.0 |
| CVE-2018-1000192 | 4.3 | Jun 5 | A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read… Affected: 1.9.0 |
Showing 50