CVE-2019-10289

A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpldoValidateAPI form validation method allowed attackers to initiate a connection to an attacker-specified server...

CVE-2019-10290

A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpldoValidateAPI form validation method allowed attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

CVE-2019-10291

Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10290

CVE-2019-10290 affects Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older. The vulnerability is a missing permission check in NCScanBuilder.DescriptorImpl#doValidateAPI, allowing attackers with Overall/Read permission to initiate a connection to an attacker-controlled server. Impact: potential ...

CVE-2019-10291

Summary (concrete details): CVE-2019-10291 concerns the Jenkins Netsparker Cloud Scan Plugin (version 1.1.5 and older) which stored credentials in plaintext in the Jenkins master/global configuration file, exposing them to anyone with file-system access. Related connected data show the Enterprise...

CVE-2019-10289

Jenkins Netsparker Cloud Scan Plugin

CVE-2019-10291: Insufficiently Protected Credentials

Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10290: Missing Authorization

A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpldoValidateAPI form validation method allowed attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

PT-2019-11692 · Jenkins · Jenkins Netsparker Cloud Scan Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Netsparker Cloud Scan Plugin version 1.1.5 and older Description: A missing permission check in the NCScanBuilder.DescriptorImpldoValidateAPI form validation method allows attackers with Overall/Read permission to initiate a connectio...

CVE-2019-10289: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpldoValidateAPI form validation method allowed attackers to initiate a connection to an attacker-specified server...

CSRF vulnerability and missing permission check in netsparker-cloud-scan allowed SSRF

A missing permission check in a form validation method in netsparker-cloud-scan allowed users with Overall/Read permission to initiate a connection test to an attacker-specified server with attacker-specified API token. Additionally, the form validation method did not require POST requests,...

netsparker-cloud-scan stored credentials in plain text

netsparker-cloud-scan stored API tokens unencrypted in its global configuration file com.netsparker.cloud.plugin.NCScanBuilder.xml on the Jenkins controller. These API tokens could be viewed by users with access to the Jenkins controller file system. netsparker-cloud-scan now stores API tokens...