Exposure of System-scoped credentials in horreum

horreum 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to have Jenkins send credentials they are not...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the storage of authentication tokens in plaintext within config.xml files on the controller. An attacker can gain unauthorized access to sensitive credentials by obtaining Item/Extended Read...

Open Redirect

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Open Redirect due to improper handling of redirects that start with backslash characters. An attacker can mislead users to malicious sites by crafting a Jenkins URL...