561 matches found
GHSA-FHMF-XF2Q-4M8P Missing permission checks in Jenkins Fortify on Demand Plugin
A missing permission check in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs. This form validation method requires appropriate permission in...
GHSA-P364-XFP2-F9RR CSRF vulnerability in Jenkins Fortify on Demand Plugin
A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs. This form validation method requires appropriate permission in Fortify on...
GHSA-FPH2-FWJQ-PRJF Users with Overall/Read access could enumerate credentials IDs in Jenkins Fortify on Demand Plugin
Fortify on Demand Plugin provides a list of applicable credentials IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions in Fortify on Demand Plugin 6.0.0 and earlier, allowing any user with Overall/Read permission to get a lis...
CSRF vulnerability in Jenkins Fortify on Demand Plugin
A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs. This form validation method requires appropriate permission in Fortify on...
Users with Overall/Read access could enumerate credentials IDs in Jenkins Fortify on Demand Plugin
Fortify on Demand Plugin provides a list of applicable credentials IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions in Fortify on Demand Plugin 6.0.0 and earlier, allowing any user with Overall/Read permission to get a lis...
Fortify Plugin stored credentials in plain text
Fortify Plugin 19.1.29 and earlier stored its proxy server password unencrypted in job config.xml files. This password could be read by users with the Extended Read permission. Fortify Plugin 19.2.30 now encrypts the proxy server password...
GHSA-XR37-PJFH-QWWC Fortify Plugin stored credentials in plain text
Fortify Plugin 19.1.29 and earlier stored its proxy server password unencrypted in job config.xml files. This password could be read by users with the Extended Read permission. Fortify Plugin 19.2.30 now encrypts the proxy server password...
GHSA-HHHH-69QP-5P2V Jenkins Fortify on Demand Plugin stores credentials in plain text
Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system...
Jenkins Fortify on Demand Plugin stores credentials in plain text
Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system...
Arbitrary file write vulnerability in Jenkins Fortify CloudScan Plugin
A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the permissions of the user the Jenkins...
GHSA-8864-PWHG-3MP2 Arbitrary file write vulnerability in Jenkins Fortify CloudScan Plugin
A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the permissions of the user the Jenkins...
Jenkins Fortify on Demand Uploader Plugin CSRF vulnerability
A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an attacker-specified server...
GHSA-7JCX-J6GV-M4HF Jenkins Fortify on Demand Uploader Plugin CSRF vulnerability
A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an attacker-specified server...
GHSA-H3RG-4H5G-8FQG SSRF vulnerability due to missing permission check in Fortify on Demand Uploader Plugin
A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...
SSRF vulnerability due to missing permission check in Fortify on Demand Uploader Plugin
A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...
GSD-2022-1002477 MIPS: fix fortify panic when copying asm exception handlers
MIPS: fix fortify panic when copying asm exception handlers This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...
GSD-2022-1002406 MIPS: fix fortify panic when copying asm exception handlers
MIPS: fix fortify panic when copying asm exception handlers This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.276 by commit...
GSD-2022-1002318 MIPS: fix fortify panic when copying asm exception handlers
MIPS: fix fortify panic when copying asm exception handlers This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.238 by commit...
GSD-2022-1002194 MIPS: fix fortify panic when copying asm exception handlers
MIPS: fix fortify panic when copying asm exception handlers This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.189 by commit...
GSD-2022-1001999 MIPS: fix fortify panic when copying asm exception handlers
MIPS: fix fortify panic when copying asm exception handlers This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.111 by commit...