113 matches found
CVE-2019-10434
Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...
PT-2019-11828 · Jenkins · Jenkins Ldap Email Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins LDAP Email Plugin affected versions not specified Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...
CVE-2019-10428
Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...
CVE-2019-10370
Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting in their exposure...
PT-2019-11766 · Jenkins · Jenkins Mask Passwords Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Mask Passwords Plugin versions 2.12.0 and earlier Description: The issue allows globally configured passwords to be transmitted in plain text as part of the configuration form, potentially exposing them. Recommendations: For Jenkins...
PT-2019-11709 · Jenkins · Jenkins Static Analysis Utilities Plugin +2
Name of the Vulnerable Software and Affected Versions: Jenkins Static Analysis Utilities Plugin version 1.95 and earlier Jenkins analysis-core Plugin affected versions not specified Description: A cross-site request forgery issue exists due to the lack of permission checks and the acceptance of...
CVE-2018-0666
Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be...
Design/Logic Flaw
Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, as demonstrated by the JDK tool in Jenkins core and the Ant tool in the Ant plugin, aka SECURITY-624...
CVE-2017-1000114
The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the API key for example through browser...
Cross site scripting
The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the API key for example through browser...
CVE-2013-1832
repository/webdav/lib.php in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 includes the WebDAV password in the configuration form, which allows remote authenticated administrators to obtain sensitive information by configuring an instance...
UBUNTU-CVE-2013-1832
repository/webdav/lib.php in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 includes the WebDAV password in the configuration form, which allows remote authenticated administrators to obtain sensitive information by configuring an instance...
