CloudBees Jenkins Fortify on Demand Plugin Authorization Issue Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based continuous integration tools from CloudBees. The product is mainly used to monitor the continuous software version of the release/testing project and some timed tasks . Fortify on Demand Plugin is used in one of the support for uploading code...

PT-2020-12283 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak versions 8.0.2 through 9.0.0 Description: A flaw was found where a malicious user can register as oneself and then use the "remove devices" form to post different credential IDs with the hope of removing MFA devices for other users...

CVE-2019-16566

A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

Users with Overall/Read access can enumerate credential IDs in teamconcert

teamconcert 1.3.0 and earlier provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those can be...

PT-2019-11867 · Jenkins · Jenkins Libvirt Slaves Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Libvirt Slaves Plugin affected versions not specified Description: A missing permission check in form-related methods of the Jenkins Libvirt Slaves Plugin allowed users with Overall/Read access to enumerate credentials ID of credentia...

CSRF vulnerability and missing permission checks in kubernetes-ci allowed capturing credentials

kubernetes-ci does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkin...

Users with Overall/Read access could enumerate credential IDs in crx-content-package-deployer

crx-content-package-deployer provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use. This functionality did not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be...

Users with Overall/Read access are able to enumerate credential IDs in ansible-tower

ansible-tower provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack ...

PT-2019-11330 · Jenkins · Jenkins Azure Vm Agents Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Azure VM Agents Plugin versions 0.8.0 and earlier Description: An information exposure issue exists that allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This is due to a...

Unprivileged users with Overall/Read access are able to enumerate credential IDs in Azure VM Agents Plugin

Azure VM Agents Plugin provides a list of applicable credential IDs to allow administrators configuring the plugin to select the one to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as...

Jenkins Google Play Android Publisher Plugin Information Disclosure Vulnerability

Jenkins is an open source software project , is based on Java development of a continuous integration tool . A security vulnerability exists in the GooglePlayBuildStepDescriptor.java file in Jenkins Google Play Android Publisher Plugin 1.6 and earlier versions. An attacker can exploit the...