Users with Overall/Read access could enumerate credentials IDs in fortify-on-demand-uploader

fortify-on-demand-uploader provides a list of applicable credentials IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions in fortify-on-demand-uploader 6.0.0 and earlier, allowing any user with Overall/Read permission to get a...

PT-2020-15417 · Jenkins · Jenkins Fortify On Demand Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Fortify on Demand Plugin versions 5.0.1 and earlier Description: A cross-site request forgery issue allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs. This issue...

wavpack security update

5.1.0-15 - fix Out-of-bounds read in WavpackVerifySingleBlock function 1663151 - CVE-2018-19841 5.1.0-14 - fix uninitialized variable in ParseCaffHeaderConfig 1741251 - CVE-2019-1010317 5.1.0-13 - fortify parsing of .dff files 1707428, 1733627 - CVE-2019-1010315 - CVE-2019-11498 5.1.0-12 - fix...

[Important] [Security] Virtuozzo PowerPanel Update 1 Hotfix 2 (7.0.4-47)

The update for Virtuozzo PowerPanel introduces a new feature and a security fix. Vulnerability id: PP-647 Fortify Docker configuration in the vzapi-compute service...

CVE-2014-2228

The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages...

Deserialization of untrusted data

The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages...

CVE-2014-2228

The CVE-2014-2228 issue affects the XStream extension in HP Fortify SCA prior to version 2.2 RC3, where unsafe deserialization of XML messages allows remote attackers to execute arbitrary code. The affected component is the XStream extension, with the root cause described as unsafe XML deserializ...

CVE-2014-2228

The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages...

PT-2020-7623

Name of the Vulnerable Software and Affected Versions HP Fortify SCA versions prior to 2.2 RC3 Description The issue allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages. This is related to the XStream extension in HP Fortify SCA. Recommendations For versio...

CVE-2014-2228: Improper Restriction of Recursive Entity References in DTDs

The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages...

FreeBSD : jenkins -- multiple vulnerabilities (a250539d-d1d4-4591-afd3-c8bdfac335d8)

Jenkins Security Advisory : DescriptionHigh SECURITY-1682 / CVE-2020-2099 Inbound TCP Agent Protocol/3 authentication bypass Medium SECURITY-1641 / CVE-2020-2100 Jenkins vulnerable to UDP amplification reflection attack Medium SECURITY-1659 / CVE-2020-2101 Non-constant time comparison of inbound...

CVE-2020-2107

Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2020-2107

Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

Design/Logic Flaw

Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2020-2107

Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2020-2107

Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2020-2107

CVE-2020-2107 affects Jenkins Fortify Plugin versions 19.1.29 and earlier. The issue is that proxy server passwords are stored unencrypted in job config.xml on the Jenkins master and can be read by users with Extended Read permission or access to the master filesystem. Impact is exposure of crede...

fortify stored credentials in plain text

fortify 19.1.29 and earlier stored its proxy server password unencrypted in job config.xml files. This password could be read by users with the Extended Read permission. fortify 19.2.30 now encrypts the proxy server password...

CVE-2020-2107: Insufficiently Protected Credentials

Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

PT-2020-15314 · Jenkins · Jenkins Fortify Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Fortify Plugin versions 19.1.29 and earlier Description: The issue concerns the storage of proxy server passwords in an unencrypted manner within job config.xml files on the Jenkins master. These passwords can be accessed by users who...