CSRF vulnerability and missing permission checks in Slack Notification Plugin allowed capturing credentials

Slack Notification Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stor...

CSRF vulnerability and missing permission checks in Cloud Foundry Plugin allowed capturing credentials

Cloud Foundry Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

CVE-2018-1000421

An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to initiate a test connection to an attacker-specified Mesos server with attacker-specified credentials IDs obtained through another method,...

CVE-2018-1000421: Server-Side Request Forgery (SSRF)

An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to initiate a test connection to an attacker-specified Mesos server with attacker-specified credentials IDs obtained through another method,...

PT-2019-8723

Name of the Vulnerable Software and Affected Versions Jenkins Jira Plugin versions 3.0.1 and earlier Description An improper authorization issue exists in the JiraSite.java component, allowing attackers with Overall/Read access to connect Jenkins to an attacker-specified URL using...

PT-2019-8729

Name of the Vulnerable Software and Affected Versions Jenkins HipChat Plugin versions 2.2.0 and earlier Description An improper authorization issue exists in the Jenkins HipChat Plugin, specifically in HipChatNotifier.java, allowing attackers with Overall/Read access to send test notifications to...

CVE-2018-1000412: Incorrect Authorization

An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...

CSRF vulnerability and missing permission checks in Jira Plugin allowed capturing credentials

Jira Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CSRF vulnerability and missing permission checks in Chatter Notifier Plugin allowed capturing credentials

Chatter Notifier Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored...

CSRF vulnerability and missing permission checks in Argus Notifier Plugin allowed capturing credentials

Argus Notifier Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored i...

CSRF vulnerability and missing permission checks in HipChat Plugin allowed capturing credentials

HipChat Plugin did not perform permission checks on a method that sends test notifications. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified HipChat server using attacker-specified connection settings and credentials IDs obtained through another method,...

CloudBees Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin Information Disclosure Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . Maven Artifact ChoiceListProvider...

CVE-2018-1999028

CVE-2018-1999028 affects Jenkins CloudBees Accurev Plugin (0.7.16 and earlier) via AccurevSCM.java, where a flaw allows capturing credentials stored in Jenkins using a known credential ID. Technical details in connected records confirm the vulnerability, its impact on credentials, and that remedi...

PT-2018-15207

Name of the Vulnerable Software and Affected Versions Jenkins Accurev Plugin versions 0.7.16 and earlier Description A sensitive information exposure issue exists, allowing attackers to capture credentials with a known credentials ID stored in Jenkins. This occurs due to a vulnerability in the...

PT-2018-15206

Name of the Vulnerable Software and Affected Versions Jenkins SaltStack Plugin versions 3.1.6 and earlier Description An exposure of sensitive information issue exists in the Jenkins SaltStack Plugin, specifically in SaltAPIBuilder.java and SaltAPIStep.java. This allows attackers to capture...

CVE-2018-1999040: Exposure of Sensitive Information to an Unauthorized Actor

An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins...

CVE-2018-1999028: Exposure of Sensitive Information to an Unauthorized Actor

An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins...

CSRF vulnerability and missing permission checks in Kubernetes Plugin allowed capturing credentials

Kubernetes Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified Kubernetes cluster using attacker-specified credentials IDs obtained through another method, capturing credentia...

CSRF vulnerability and missing permission checks in Accurev Plugin allowed capturing credentials

Accurev Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified Accurev server using attacker-specified credentials IDs obtained through another method, capturing credentials stor...

CSRF vulnerability and missing permission checks in SaltStack Plugin allowed capturing credentials

SaltStack Plugin did not perform permission checks on methods implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...