CVE-2020-2143

Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

PT-2020-15375 · Jenkins · Jenkins Skytap Cloud Ci Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Skytap Cloud CI Plugin versions 2.07 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. The credentials are...

PT-2020-15362 · Jenkins · Jenkins Quality Gates Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Quality Gates Plugin versions 2.5 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form. This potentially results in their exposure. The...

PT-2020-15356 · Jenkins · Credentials Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins Zephyr Enterprise Test Management Plugin versions 1.9.1 and earlier Description: The issue concerns the storage of the Zephyr password in plain text on the Jenkins master file system, specifically in the global configuration file...

PT-2020-15372 · Jenkins · Jenkins Openshift Deployer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OpenShift Deployer Plugin versions 1.2.0 and earlier Description: The issue is related to the transmission of configured credentials in plain text as part of the global Jenkins configuration form. This potentially results in their...

PT-2020-15354 · Jenkins · Jenkins Logstash Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Logstash Plugin versions 2.3.1 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form. This potentially results in their exposure through...

Credentials transmitted in plain text by sonar-quality-gates

sonar-quality-gates stores credentials in its global configuration file org.quality.gates.jenkins.plugin.GlobalConfig.xml on the Jenkins controller as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration for...

PT-2020-15360 · Jenkins · Jenkins Repository Connector Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Repository Connector Plugin versions 1.2.6 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form. Although credentials are stored encrypte...

PT-2020-15361 · Jenkins · Jenkins Sonar Quality Gates Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Sonar Quality Gates Plugin versions 1.3.1 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

PT-2020-15370 · Jenkins · Jenkins Backlog Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Backlog Plugin versions 2.4 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. Credentials are stored...

CVE-2020-2145: Insufficiently Protected Credentials

Jenkins Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text on the Jenkins master file system...

Credentials stored in plain text by zephyr-enterprise-test-management

zephyr-enterprise-test-management 1.9.1 and earlier stores its Zephyr password in plain text in the global configuration file com.thed.zephyr.jenkins.reporter.ZeeReporter.xml. This password can be viewed by users with access to the Jenkins controller file system. zephyr-enterprise-test-management...

Credentials transmitted in plain text by skytap

skytap stores credentials in job config.xml files as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by skytap 2.07 and earlier. These credentials could be viewed by users with Extended Read...

Credentials transmitted in plain text by logstash

logstash stores credentials in its global configuration file jenkins.plugins.logstash.LogstashConfiguration.xml on the Jenkins controller as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by...

Credentials transmitted in plain text by repository-connector

repository-connector stores credentials in its global configuration file org.jvnet.hudson.plugins.repositoryconnector.RepositoryConfiguration.xml on the Jenkins controller as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part ...

Credentials transmitted in plain text by quality-gates

quality-gates stores credentials in its global configuration file quality.gates.jenkins.plugin.GlobalConfig.xml on the Jenkins controller as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by...

Credentials transmitted in plain text by backlog

backlog stores credentials in job config.xml files as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by backlog 2.4 and earlier. These credentials could be viewed by users with Extended Read...

Credentials transmitted in plain text by openshift-deployer

openshift-deployer stores credentials in its global configuration file org.jenkinsci.plugins.openshift.DeployApplication.xml on the Jenkins controller as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration...

Credentials transmitted in plain text by deployhub

deployhub stores credentials in job config.xml files as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by deployhub 8.0.14 and earlier. These credentials could be viewed by users with Extended Rea...

undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...