CVE-2019-10429

The CVE refers to the Jenkins GitLab Logo Plugin, where credentials are stored unencrypted in the plugin’s or Jenkins master’s global configuration file. The underlying issue is that sensitive data is kept in plaintext on the Jenkins master filesystem and could be viewed by users with access to t...

CVE-2019-10430

CVE-2019-10430 affects the Jenkins NeuVector Vulnerability Scanner Plugin (versions 1.5 and earlier). The root cause is that credentials are stored unencrypted in the plugin’s global configuration file on the Jenkins master, which could be viewed by users with access to the master file system. Im...

CVE-2019-10429

Jenkins GitLab Logo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-10424

CVE-2019-10424 affects the Jenkins elOyente Plugin, which stores credentials unencrypted in the plugin’s global configuration file on the Jenkins master. This allows users with file-system access to the Jenkins controller to view sensitive data. Multiple sources corroborate the issue; however, pu...

CVE-2019-10428

Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2019-10419

Jenkins vFabric Application Director Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-10420

Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-10419

CVE-2019-10419 affects Jenkins via the vFabric Application Director Plugin, where credentials are stored unencrypted in the plugin’s global configuration file on the Jenkins controller. The underlying issue is unencrypted credential storage in the Application Director Plugin’s configuration file ...

CVE-2019-10420

The CVE-2019-10420 affects the Jenkins Assembla Plugin, which stores the Assembla password unencrypted in the plugin’s global configuration file (jenkins.plugin.assembla.AssemblaProjectProperty.xml) on the Jenkins controller. This allows anyone with access to the Jenkins master/file system to vie...

CVE-2019-10415

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10423

Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-10406

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission...

CVE-2019-10406

CVE-2019-10406 affects Jenkins 2.196 and earlier, including LTS 2.176.3 and earlier. The root cause is that the global configuration did not restrict or filter values set in the Jenkins URL field, allowing a stored XSS vulnerability. Exploitation requires Overall/Administer permission and can be ...

PT-2019-11817 · Jenkins · Jenkins Codescan Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins CodeScan Plugin affected versions not specified Description: The issue concerns the storage of sensitive information in an unencrypted manner. Specifically, the Jenkins CodeScan Plugin stores credentials and an API key unencrypted in...

PT-2019-11800 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.196 and earlier Jenkins LTS versions 2.176.3 and earlier Description: The issue results from a lack of restriction or filtering on values set as the Jenkins URL in the global configuration, leading to a stored XSS...

PT-2019-11814 · Jenkins · Jenkins Assembla Auth Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Assembla Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file of the Jenkins Assembla Plugin on the Jenkins master or controlle...

PT-2019-11824 · Jenkins · Jenkins Neuvector Vulnerability Scanner Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins NeuVector Vulnerability Scanner Plugin versions 1.5 and earlier Description: The issue allows stored credentials to be viewed unencrypted in the global configuration file on the Jenkins master by users with access to the master file...

PT-2019-11809 · Jenkins · Jenkins Violation Comments To Gitlab Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Violation Comments to GitLab Plugin version 2.28 and earlier Description: The issue concerns the storage of credentials in an unencrypted manner. Specifically, the plugin stored API tokens unencrypted in job config.xml files and its...

PT-2019-11805 · Jenkins · Jenkins Inedo Buildmaster Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Inedo BuildMaster Plugin versions 2.4.0 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure...

PT-2019-11806 · Jenkins · Jenkins Inedo Proget Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Inedo ProGet Plugin versions 1.2 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure. Specificall...