99 matches found
Missing permission checks in deployit-plugin allow enumerating credentials IDs
deployit-plugin 26.1.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...
CVE-2026-70445
Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-70447
Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-70445
Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
Missing permission checks in sauce-ondemand allow enumerating credentials IDs
sauce-ondemand 2.2.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...
CVE-2026-57293
The Jenkins Gitee Plugin (version 1288.v18b_deb_c9069b_ and earlier) contains an incorrect permission check in an HTTP endpoint. This flaw allows attackers who possess global Item/Configure permissions, but lack specific Item/Configure permissions on individual jobs, to enumerate credentials IDs ...
Incorrect permission check in gitee allows enumerating credentials IDs
gitee 1288.v18bdebc9069b and earlier does not correctly perform a permission check in an HTTP endpoint. This allows attackers with global Item/Configure permission while lacking Item/Configure permission on any particular job to enumerate credentials IDs of credentials stored in Jenkins. Those ca...
CVE-2026-48926
Jenkins Job Import Plugin 143.v044a2e819b27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
EUVD-2026-32517
Jenkins Job Import Plugin 143.v044a2e819b27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
Missing permission check in job-import-plugin allows enumerating credentials IDs
job-import-plugin 143.v044a2e819b27 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using anothe...
CVE-2026-4113
An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials...
Missing permission check in BlazeMeterJenkinsPlugin allows enumerating credentials IDs
BlazeMeterJenkinsPlugin 4.26 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...
EUVD-2025-36645
Jenkins Publish to Bitbucket Plugin is missing a permissions check...
Missing permission check in publish-to-bitbucket allows enumerating credentials IDs
publish-to-bitbucket 0.4 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials...
EUVD-2023-3006
Malicious code in bioql PyPI...
EUVD-2023-0486
Malicious code in bioql PyPI...
EUVD-2022-3021
Malicious code in bioql PyPI...
EUVD-2022-0779
Malicious code in bioql PyPI...
EUVD-2022-6356
Malicious code in bioql PyPI...
CVE-2023-28673
A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...