CVE-2015-8031

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Hudson (aka org.jvnet.hudson.main:hudson-core) before 3.3.2 allows XXE attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/advisories/GHSA-j3h2-8mf8-j5r2Exploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGJVNETHUDSONMAIN-31221Exploit, Third Party Advisory
https://wiki.eclipse.org/Hudson-ci/alerts/CVE-2015-8031Vendor Advisory
https://github.com/advisories/GHSA-j3h2-8mf8-j5r2Exploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGJVNETHUDSONMAIN-31221Exploit, Third Party Advisory
https://wiki.eclipse.org/Hudson-ci/alerts/CVE-2015-8031Vendor Advisory

Timeline

Published: Jul 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-80325.3In Textpattern 4.5.7, an unprivileged author can change an article's markup setting.CVE-2015-80335.3In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account.CVE-2015-80343.3The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive informa CVE-2015-80352.6The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to CVE-2015-80366.8Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a CVE-2015-80374.3Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote CVE-2015-80384.3Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote CVE-2015-80396.8Samsung SmartViewer allows remote attackers to execute arbitrary code via unspecified vectors to the (1) DVRSetupSave method in the STWAxCon CVE-2015-80406.8The rtsp_getdlsendtime method in the CNC_Ctrl control in Samsung SmartViewer allows remote attackers to execute arbitrary code via an index CVE-2015-80415.0Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a d CVE-2015-80429.3Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 CVE-2015-804310.0Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548