202 matches found
CVE-2023-25768
A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server...
CVE-2023-25767
A cross-site request forgery CSRF vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-specified web server...
CVE-2023-25766
CVE-2023-25766 concerns the Jenkins Azure Credentials Plugin (253.v887e0f9e898b and earlier). The root cause is a missing permission check that lets an attacker with Overall/Read access enumerate credential IDs stored in Jenkins. The vulnerability primarily enables information disclosure of crede...
Jenkins Enterprise and Operations Center 2.346.x < 2.346.40.0.9 Multiple Vulnerabilities (CloudBees Security Advisory 2023-02-15)
The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.346.x prior to 2.346.40.0.9. It is, therefore, affected by multiple vulnerabilities including the following: - CSRF vulnerability and missing permission checks in Synopsys Coverity Plugin allow...
API keys stored in plain text by Jenkins Katalon Plugin
Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Katalon Plugin 1.0.33 no...
GHSA-35RX-7PC8-6963 API keys stored in plain text by Jenkins Katalon Plugin
Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Katalon Plugin 1.0.33 no...
API keys stored in plain text by Katalon
Katalon 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Katalon 1.0.33 no longer stores the API...
Jenkins Credentials Plugin Cross-site Scripting (CVE-2022-29036)
A cross-site scripting vulnerability exists in Jenkins Credentials Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...
credentials: Stored XSS vulnerabilities in jenkins plugin
A flaw was found in the Jenkins credentials plugin. The Jenkins credentials plugin does not escape the name and description of Credentials parameters on views displaying parameters. This issue results in a stored Cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure...
credentials: Stored XSS vulnerabilities in jenkins plugin
A flaw was found in the Jenkins credentials plugin. The Jenkins credentials plugin does not escape the name and description of Credentials parameters on views displaying parameters. This issue results in a stored Cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure...
Credentials stored in plain text by Zephyr Enterprise Test Management Plugin
Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text in the global configuration file com.thed.zephyr.jenkins.reporter.ZeeReporter.xml. This password can be viewed by users with access to the Jenkins controller file system. Zephyr Enterprise Test...
GHSA-XV58-GP43-6M76 Credentials stored in plain text by Zephyr Enterprise Test Management Plugin
Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text in the global configuration file com.thed.zephyr.jenkins.reporter.ZeeReporter.xml. This password can be viewed by users with access to the Jenkins controller file system. Zephyr Enterprise Test...
GHSA-8QH4-FGHR-6FXG Improper Limitation of a Pathname to a Restricted Directory in Jenkins Google OAuth Credentials Plugin
An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master...
sp.sd:nexus-artifact-uploader (>=2.1, <=2.2) potentially affected by CVE-2019-10320 via org.jenkins-ci.plugins:credentials (1.26)
org.jenkins-ci.plugins:credentials MAVEN version 1.26 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - sp.sd:nexus-artifact-uploader =2.1, =2.2 Source cves: CVE-2019-10320 Source advisory:...
com.tikalk.hudson.plugins:notification (>=1.12, <=1.13), net.praqma:memory-map (>=2.2.0, <=2.2.1) +36 more potentially affected by CVE-2019-10320 via org.jenkins-ci.plugins:credentials (1.21)
org.jenkins-ci.plugins:credentials MAVEN version 1.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - com.tikalk.hudson.plugins:notification =1.12, =2.2.0, =3.0-rc1, =1.2.1, =1.14.2, =2.3,...
org.jenkins-ci.plugins:bitbucket-approve (>=1.0.1, <=1.0.3), org.jenkins-ci.plugins:git (>=2.2.10, <=2.3.2) +1 more potentially affected by CVE-2019-10320 via org.jenkins-ci.plugins:credentials (1.19)
org.jenkins-ci.plugins:credentials MAVEN version 1.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:bitbucket-approve =1.0.1, =2.2.10, =1.1.0, =1.1.4 Source cves:...
com.blackducksoftware.integration:blackduck-detect (>=1.0.0, <=1.2.0), com.blackducksoftware.integration:blackduck-hub (>=2.2.0, <=3.1.0) +30 more potentially affected by CVE-2019-10320 via org.jenkins-ci.plugins:credentials (1.9.4)
org.jenkins-ci.plugins:credentials MAVEN version 1.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - com.blackducksoftware.integration:blackduck-detect =1.0.0, =2.2.0, =1.27, =0.3.4, =0.1.2,...
com.aliyun.www:aliyun-container-service-deploy (0.1.0), de.tsystems.mms.apm:loadrunner (1.1) +10 more potentially affected by CVE-2019-10320 via org.jenkins-ci.plugins:credentials (1.18)
org.jenkins-ci.plugins:credentials MAVEN version 1.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - com.aliyun.www:aliyun-container-service-deploy 0.1.0 - de.tsystems.mms.apm:loadrunner 1.1 -...
GHSA-XM94-9JW8-P6HW Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS12 certificate...
Jenkins Enterprise and Operations Center 2.277.x < 2.277.43.0.8 / 2.303.x < 2.303.30.0.7 / 2.332.1.5 Multiple Vulnerabilities (CloudBees Security Advisory 2022-03-15)
The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.277.x prior to 2.277.43.0.8, 2.303.x prior to 2.303.30.0.7, or 2.x prior to 2.332.1.5. It is, therefore, affected by multiple vulnerabilities, including the following: - A cross-site request forge...