CVE-2020-2301: Undefined Security Weakness

Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode...

CVE-2020-2299: Undefined Security Weakness

Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password...

PT-2020-15533 · Jenkins · Jenkins Active Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.19 and earlier Description: A cross-site request forgery CSRF issue allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers...

Input validation

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...

CVE-2019-1003009

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...

CVE-2019-1003009

The CVE-2019-1003009 issue affects Jenkins Active Directory Plugin 2.10 and earlier. A improper certificate validation vulnerability exists in ActiveDirectoryDomain.java, ActiveDirectorySecurityRealm.java, and ActiveDirectoryUnixAuthenticationProvider.java that lets an attacker impersonate the Ac...

CVE-2019-1003009

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...

CVE-2019-1003009: Improper Certificate Validation

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...

PT-2019-11307 · Jenkins · Jenkins Active Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.10 and earlier Description: An issue exists in the improper validation of certificates, allowing attackers to impersonate the Active Directory server that Jenkins connects to for authentication when...

CVE-2017-2649

It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks...

CVE-2017-2649

It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks...

CVE-2017-2649: Improper Certificate Validation

It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks...

PT-2018-7157

Name of the Vulnerable Software and Affected Versions: Active Directory Plugin for Jenkins versions up to and including 2.2 Description: The issue allows for Man-in-the-Middle attacks due to the lack of certificate verification of the Active Directory server. Recommendations: For versions up to a...

CloudBees Jenkins Active Directory Plugin Security Bypass Vulnerability

Jenkins is the open source automation server.Jenkins provides numerous plug-ins to support building, deploying and automating projects.Jenkins Active Directory plug-in is one of the plug-ins to configure Jenkins via Active Directory authentication username and password. A security bypass...

CVE-2016-0770

Cross-site scripting XSS vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s variable...