CVE-2019-16559: Incorrect Default Permissions

A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system...

PT-2019-14715 · Jenkins · Jenkins Websphere Deployer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins WebSphere Deployer Plugin version 1.6.1 and earlier Description: A cross-site request forgery issue allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master...

SSL/TLS certificate validation globally and unconditionally disabled by websphere-deployer

websphere-deployer 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM, or specify a new Java keystore from a file stored on the Jenkins controller filesystem. As of publication of this advisory, ther...

wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default

It was found that Wildfly users had default user permissions set incorrectly. A malicious user could use this flaw to access unauthorized controls for the application server...

wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default

It was found that Wildfly users had default user permissions set incorrectly. A malicious user could use this flaw to access unauthorized controls for the application server...

wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default

It was found that Wildfly users had default user permissions set incorrectly. A malicious user could use this flaw to access unauthorized controls for the application server...

wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default

It was found that Wildfly users had default user permissions set incorrectly. A malicious user could use this flaw to access unauthorized controls for the application server...

wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default

It was found that Wildfly users had default user permissions set incorrectly. A malicious user could use this flaw to access unauthorized controls for the application server...

wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default

It was found that Wildfly users had default user permissions set incorrectly. A malicious user could use this flaw to access unauthorized controls for the application server...

wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default

It was found that Wildfly users had default user permissions set incorrectly. A malicious user could use this flaw to access unauthorized controls for the application server...

wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default

It was found that Wildfly users had default user permissions set incorrectly. A malicious user could use this flaw to access unauthorized controls for the application server...

Unspecified Vulnerability in CloudBees Jenkins CRX Content Package Deployer Plugin

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . CRX Content Package Deployer Plugin is used in...

Unspecified Vulnerability in CloudBees Jenkins CRX Content Package Deployer Plugin (CNVD-2019-42835)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . CRX Content Package Deployer Plugin is used in...

CloudBees Jenkins CRX Content Package Deployer Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . CRX Content Package Deployer Plugin is used in...

CSRF vulnerability and missing permission check in weblogic-deployer-plugin

weblogic-deployer-plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to send an HTTP HEAD request to a user-specified URL, or confirm the existence of any file or directory on the Jenkins controller...

CVE-2019-10437

A cross-site request forgery vulnerability in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2019-10437

A cross-site request forgery vulnerability in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2019-10439

A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

CVE-2019-10439

A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

Cross site request forgery (csrf)

A cross-site request forgery vulnerability in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...