Business Directory Plugin < 5.11.1 - Arbitrary Add/Edit/Delete Form Field to Stored XSS

The plugin suffered from Cross-Site Request Forgery issues, allowing an attacker to make a logged in administrator add, edit or delete form fields, which could also lead to Stored Cross-Site Scripting issues. Note WPScanTeam: The CSRF has ben fixed and proper capability checks have also been adde...

CloudBees Jenkins Active Directory Plugin Authorization Issue Vulnerability (CNVD-2020-61922)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Active Directory Plugin is used in which an...

CloudBees Jenkins Active Directory Plugin Authorization Issue Vulnerability (CNVD-2020-62249)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Active Directory Plugin is used in one of th...

CloudBees Jenkins Active Directory Plugin Authorization Issue Vulnerability (CNVD-2020-61923)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Active Directory Plugin is used in which an...

CloudBees Jenkins Active Directory Plugin Authorization Issues Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Active Directory Plugin is used in one of th...

CVE-2020-2303

A cross-site request forgery CSRF vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials...

CVE-2020-2302

A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page...

CVE-2020-2302

A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page...

CVE-2020-2299

Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password...

CVE-2020-2299

Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password...

CVE-2020-2303

CVE-2020-2303 describes a CSRF vulnerability in Jenkins Active Directory Plugin (versions 2.19 and earlier) that allows an attacker to trigger connection tests against AD servers using attacker-supplied credentials. The root cause is endpoints performing connection/authentication tests without re...

CVE-2020-2303

A cross-site request forgery CSRF vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials...

CVE-2020-2302

CVE-2020-2302 affects Jenkins Active Directory Plugin 2.19 and earlier, where a missing permission check allows attackers with Overall/Read permission to access the domain health check diagnostic page. The issue is fixed by upgrading to version 2.20, which enforces Overall/Administer permission f...

CVE-2020-2301

The CVE-2020-2301 issue affects Jenkins Active Directory Plugin (versions 2.19 and earlier). In Windows/ADSI mode, the plugin’s authentication cache could cause a login to be successful for any user with any password because the provided password was not validated when a cache entry existed. This...

CVE-2020-2300

CVE-2020-2300 affects Jenkins Active Directory Plugin ≥2.19 and earlier. In Windows/ADSI mode the plugin does not prohibit empty passwords, enabling unauthorized logins to Jenkins depending on Active Directory server configuration. Mitigation: upgrade to version 2.20 or 2.16.1 which prohibit empt...

CVE-2020-2299

CVE-2020-2299 affects Jenkins Active Directory Plugin versions 1.44–2.19 and certain older ranges, where the LDAP-based mode distinguishes user lookup from authentication by using a magic constant as the password due to shared code paths. This allows an attacker to log in as any user when the mag...

PT-2020-15533 · Jenkins · Jenkins Active Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.19 and earlier Description: A cross-site request forgery CSRF issue allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers...

PT-2020-15531 · Jenkins · Jenkins Active Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.19 and earlier Jenkins Active Directory Plugin versions prior to 2.20 and 2.16.1 Description: The issue allows attackers to log in as any user with any password while a successful authentication of...

Input validation

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...

CVE-2019-1003009

The CVE-2019-1003009 issue affects Jenkins Active Directory Plugin 2.10 and earlier. A improper certificate validation vulnerability exists in ActiveDirectoryDomain.java, ActiveDirectorySecurityRealm.java, and ActiveDirectoryUnixAuthenticationProvider.java that lets an attacker impersonate the Ac...