Fixed in Apache Tomcat Native Connector 1.2.17

Moderate: Mishandled OCSP invalid response CVE-2018-8019 When using an OCSP responder Tomcat Native did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates...

CSRF vulnerability and missing permission checks in Agiletestware Pangolin Connector for TestRail Plugin allowed overriding plugin configuration

Agiletestware Pangolin Connector for TestRail Plugin did not perform permission checks on an API endpoint used to validate and save the plugin configuration. This allowed users with Overall/Read access to Jenkins to override the plugin configuration. Additionally, the API endpoint did not require...

Sending FireEye HX data to Splunk

FireEye HX is an agent-based Endpoint Protection solution. Something like an antivirus, but focused on Advanced Persistent Threats APT. It has an appliance with GUI where you can manage the agents and see information about detected security incidents. As with any agent-based solution, it's...

How to change the timeouts for the vSphere Connector

Sometimes a customer's environment is much slower than we planned for. We saw a scenario where disk moves and copies were taking several hours while still completing successfully. The vSphere connector was timing out much earlier, though. The ability to configure the timeouts is in 4.3 and all...

CloudBees Jenkins z/OS Connector Plugin Information Disclosure Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed tasks . z/OS Connector Plugin is used in one of the plug-in to support the z/OS...

Design/Logic Flaw

A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured password...

CVE-2018-1000608

A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured password...

CVE-2018-1000608

A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured password...

CVE-2018-1000608

A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured password...

CVE-2018-1000608

The CVE-2018-1000608 affects Jenkins z/OS Connector Plugin (versions up to 1.2.6.1). The vulnerability resides in SCLMSCM.java where passwords could be exposed, allowing an attacker with local file-system access or a compromised Jenkins admin browser (e.g., malicious extension) to retrieve the co...

CVE-2018-1000608

A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured password...

PT-2018-9463

Name of the Vulnerable Software and Affected Versions Jenkins z/OS Connector Plugin versions 1.2.6.1 and earlier Description A sensitive information exposure issue exists, allowing an attacker with local file system access or control of a Jenkins administrator's web browser to retrieve the...

PT-2018-3242

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.5 through 8.5.31 Apache Tomcat versions 9.0.0.M9 through 9.0.9 Description The issue is caused by synchronization errors when using a shared resource, which could allow a remote attacker to disclose protected...

CVE-2018-1000608: Insufficiently Protected Credentials

A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured password...

Fixed in Apache Tomcat 8.5.32

Important: Information Disclosure CVE-2018-8037 If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present...

IBM z/OS Connector Plugin stores password in plain text

IBM z/OS Connector Plugin did not encrypt password credentials stored in its configuration. This could be used by users with Jenkins controller file system access to obtain the password. While masked from view using a password form field, the AWS Secret Key was transferred in plain text to...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Workload Scheduler (CVE-2016-5983)

Summary IBM WebSphere Application Server is shipped as a component of Tivoli Workload Scheduler. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin for...

Security Bulletin: A security vulnerability has been identified in MySQL shipped with Tivoli Network Manager IP Edition (Oracle Critical Patch Update Advisory - January 2016)

Summary MySQL Client/Connector and Server are shipped as a component of Tivoli Network Manager IP Edition. Information about a security vulnerability affecting MySQL Server has been published. Vulnerability Details Please consult the Oracle Critical Patch Update Advisory - January 2016 for...

Security Bulletin: A security vulnerability has been identified in MySQL shipped with Tivoli Network Manager IP Edition (Oracle Critical Patch Update Advisory - October 2015)

Summary MySQL Server is shipped as a component of Tivoli Network Manager IP Edition. Information about a security vulnerability affecting MySQL Server has been published in a security bulletin Vulnerability Details Please consult the security bulletin for vulnerability details and information abo...

Security Bulletin:A security vulnerability has been identified in MySQL Server shipped with Tivoli Network Manager IP Edition (Oracle Critical Patch Update Advisory - July 2015)

Summary MySQL Server is shipped as a component of Tivoli Network Manager IP Edition. Information about a security vulnerability affecting MySQL Server has been published in a security bulletin Vulnerability Details Please consult the security bulletin...