Exposure of System-scoped credentials in horreum

horreum 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to have Jenkins send credentials they are not...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient permission validation in the process. An attacker can obtain credential identifiers by leveraging global configuration privileges without having specific job configuration permissions. Remediati...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the storage of authentication tokens in plaintext within config.xml files on the controller. An attacker can gain unauthorized access to sensitive credentials by obtaining Item/Extended Read...

Open Redirect

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Open Redirect due to improper handling of redirects that start with backslash characters. An attacker can mislead users to malicious sites by crafting a Jenkins URL...

XXE vulnerability on agents in mstest

mstest 1.0.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control the contents of the report file for the 'Publish MSTest test result report' post-build step to have agent processes parse a crafted file that uses external...

XXE vulnerability in compuware-topaz-for-total-test

compuware-topaz-for-total-test 2.4.8 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control the input files for the 'Topaz for Total Test - Execute Total Test scenarios' build step to have Jenkins parse a crafted XML documen...