Arista Networks CloudVision Portal Password Exposure (SA0045)

The version of Arista Networks CloudVision Portal running on the remote device is affected by an information disclosure vulnerability. Under certain conditions, the application logs user passwords in plain text for certain API calls, potentially leading to user password exposure. Note that Nessus...

CVE-2020-2210

Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2210

Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2210

Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2210

The CVE-2020-2210 entry concerns Jenkins Stash Branch Parameter Plugin versions 0.3.0 and earlier, where configured passwords are transmitted in plain text as part of the global Jenkins configuration form. Root cause: the plugin stores the Stash API password in the controller’s config file, and a...

CVE-2020-2210

Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

PT-2020-15434 · Jenkins · Jenkins Hp Alm Quality Center Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins HP ALM Quality Center Plugin versions 1.6 and earlier Description: The issue concerns the storage of a password in plain text in the global configuration file, specifically in...

PT-2020-15425 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins Stash Branch Parameter Plugin versions 0.3.0 and earlier Description: The issue concerns the transmission of configured passwords in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

Unspecified Vulnerability in IBM Security Identity Manager Virtual Appliance (CNVD-2020-47598)

IBM Security Identity Manager ISIM is a suite of identity management and governance solutions from IBM in the United States. The solution automates the creation, modification, re-authentication and termination of user privileges throughout the user lifecycle and supports policy-based password...

PT-2020-15428 · Jenkins · Jenkins White Source Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins White Source Plugin versions 19.1.1 and earlier Jenkins White Source Plugin versions prior to 20.8.1 Description: The issue allows credentials to be stored unencrypted in the global configuration file and in job config.xml files on th...

Password stored in plain text by hp-quality-center

hp-quality-center 1.6 and earlier stores a password in plain text in its global configuration file org.jenkinsci.plugins.qc.QualityCenterIntegrationRecorder.xml. This password can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no...

Secret stored in plain text by slack-uploader

slack-uploader 1.7 and earlier stores a secret unencrypted in job config.xml files as part of its configuration. This secret can be viewed by users with Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory, there is no fix...

Passwords transmitted in plain text by StashBranchParameter

StashBranchParameter stores Stash API passwords in its global configuration file org.jenkinsci.plugins.StashBranchParameter.StashBranchParameterDefinition.xml on the Jenkins controller as part of its configuration. While the password is stored encrypted on disk, it is transmitted in plain text as...

Secret stored in plain text by github-coverage-reporter

github-coverage-reporter 1.8 and earlier stores a GitHub access token in plain text in its global configuration file io.jenkins.plugins.gcr.PluginConfiguration.xml. This token can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no...

CVE-2020-5899

In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address ...

CVE-2020-5899

In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address ...

Design/Logic Flaw

IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171512...

CVE-2020-5899

In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address ...

CVE-2019-4676

IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171512...

CVE-2019-4676

The CVE-2019-4676 entry affects IBM Security Identity Manager Virtual Appliance 7.0.2, where user credentials are stored in plaintext and can be read by a local user. This is the underlying root cause and directly leads to exposure of credentials on affected installations. The IBM Security Identi...