2070 matches found
CVE-2019-10422
Jenkins Call Remote Job Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...
CVE-2019-10413
Jenkins Data Theorem: CI/CD Plugin 1.3 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...
CVE-2019-10412
Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...
CVE-2019-10411
Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...
PT-2019-11817 · Jenkins · Jenkins Codescan Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins CodeScan Plugin affected versions not specified Description: The issue concerns the storage of sensitive information in an unencrypted manner. Specifically, the Jenkins CodeScan Plugin stores credentials and an API key unencrypted in...
PT-2019-11805 · Jenkins · Jenkins Inedo Buildmaster Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Inedo BuildMaster Plugin versions 2.4.0 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure...
PT-2019-11821 · Jenkins · Jenkins Aqua Microscanner Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Aqua MicroScanner Plugin version 1.0.7 and earlier Description: The issue involves the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure...
CloudBees Jenkins Beaker Builder Information Disclosure Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Dependency Graph Viewer Plugin is used in...
PT-2019-11104 · Apc · Apc Ups Network Management Card 2
Name of the Vulnerable Software and Affected Versions: APC UPS Network Management Card 2 AOS version 6.5.6 Description: A Credentials Management issue exists, which could cause Remote Monitoring Credentials to be viewed in plaintext when Remote Monitoring is enabled and then disabled...
EulerOS Virtualization for ARM 64 3.0.2.0 : python-requests (EulerOS-SA-2019-1947)
According to the version of the python-requests package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 30...
Atlassian Confluence Server and Confluence Data Center File Disclosure Vulnerability
Atlassian Confluence Server is a suite of professional enterprise knowledge management and collaboration software from Atlassian Australia that can also be used to build enterprise WiKi.Confluence Data Center is the data center version of Confluence Center. A security vulnerability exists in...
CVE-2019-13348
CVE-2019-13348 affects Knowage up to 6.1.1: an authenticated user who visits the datasources page can access data source credentials in cleartext (including database credentials). Multiple connected sources corroborate this vulnerability (NVD entry, Red Hat advisory, CNVD, OSV, CVE listings). Roo...
CloudBees Jenkins JClouds Plugin Authorization Issues Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . An authorization issue vulnerability exists in CloudBees Jenkins JClouds Plugin, which can be exploited by an attacker to gain access to credentials stored in...
PT-2019-11779 · Jenkins · Jenkins Eggplant Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins eggPlant Plugin version 2.2 and earlier Description: The issue allows credentials to be stored unencrypted in job config.xml files on the Jenkins master. These credentials can be viewed by users with Extended Read permission or those...
python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 302 from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker coul...
CVE-2019-1020009
Fleet before 2.1.2 allows exposure of SMTP credentials...
CVE-2019-11273
Pivotal Container Services PKS versions 1.3.x prior to 1.3.7, and versions 1.4.x prior to 1.4.1, contains a vulnerable component which logs the username and password to the billing database. A remote authenticated user with access to those logs may be able to retrieve non-sensitive information...
CVE-2019-13099
The Momo application 2.1.9 for Android stores confidential information insecurely on the system i.e., in cleartext, which allows a non-root user to find out the username/password of a valid user and a user's access token via Logcat...
Man-in-the-Middle (MitM)
Overview yarn is a package for dependency management. Affected versions of this package are vulnerable to Man-in-the-Middle MitM. Npm credentials such as authToken were found to be sent over clear text when processing scoped packages that are listed as resolved. This could allow a suitably...