CloudBees Jenkins Code Coverage API Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

CVE-2020-2114

Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

PT-2020-15322 · Jenkins · Jenkins Junit Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins NUnit Plugin versions 0.25 and earlier Description: The issue allows a user who can control the input files for the post-build step to have Jenkins parse a crafted file that uses external entities. This can lead to extraction of secre...

PT-2020-15325 · Jenkins · Jenkins Pipeline Github Notify Step Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline GitHub Notify Step Plugin versions 1.0.4 and earlier Description: A missing permission check in form-related methods of the Jenkins Pipeline GitHub Notify Step Plugin allowed users with Overall/Read access to enumerate...

PT-2020-15302 · Jenkins · Jenkins Gitlab Hook Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Gitlab Hook Plugin versions 1.4.2 and earlier Description: The issue is related to a reflected XSS vulnerability. It occurs because project names in the "build now" endpoint are not properly escaped, allowing for potential exploitatio...

CVE-2019-16567

A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

PT-2019-14708 · Jenkins · Jenkins Build Failure Analyzer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Build Failure Analyzer Plugin versions 1.24.1 and earlier Description: A cross-site request forgery issue allows attackers to have Jenkins evaluate a computationally expensive regular expression, potentially leading to exploitation...

PT-2019-14709 · Jenkins · Jenkins Build Failure Analyzer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Build Failure Analyzer Plugin versions 1.24.1 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression...

PT-2019-14718 · Jenkins · Jenkins Mission Control Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Mission Control Plugin versions 0.9.16 and earlier Description: The issue concerns a stored XSS vulnerability. It occurs because the plugin does not properly escape job display names and build names shown on its view. This can be...

CSRF vulnerability and missing permission checks in websphere-deployer

websphere-deployer 1.6.1 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to perform connection tests, determine whether files with an attacker-specified path exist on the Jenkins controller file system, and obtain...

CloudBees Jenkins Google Compute Engine Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Google Compute Engine Plugin is used in one o...

CVE-2019-16545

Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure...

PT-2019-14700 · Jenkins · Jenkins Qmetry For Jira - Test Management Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins QMetry for JIRA - Test Management Plugin versions prior to 1.13 Description: The issue concerns the transmission of credentials in plain text as part of job configuration forms, potentially leading to their exposure. Although the...

PT-2019-14702 · Jenkins · Jenkins Google Compute Engine Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Google Compute Engine Plugin versions 4.1.1 and earlier Description: The issue is related to missing permission checks in various API endpoints, allowing attackers with Overall/Read permission to obtain limited information about the...

PT-2019-14703 · Jenkins · Jenkins Google Compute Engine Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Google Compute Engine Plugin versions 4.1.1 and earlier Description: A cross-site request forgery issue exists in the ComputeEngineClouddoProvision function, which could be used to provision new agents. The Google Compute Engine Plugi...

CVE-2019-10470

A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

PT-2019-11855 · Jenkins · Jenkins Dynatrace Application Monitoring Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Dynatrace Application Monitoring Plugin versions 2.1.3 and earlier Jenkins Dynatrace Application Monitoring Plugin versions prior to 2.1.4 Description: The issue concerns the storage of credentials in the global configuration file on...

CloudBees Jenkins Rundeck plugin cross-site request forgery vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . Rundeck Plugin is used in one of the...

PT-2019-11867 · Jenkins · Jenkins Libvirt Slaves Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Libvirt Slaves Plugin affected versions not specified Description: A missing permission check in form-related methods of the Jenkins Libvirt Slaves Plugin allowed users with Overall/Read access to enumerate credentials ID of credentia...

PT-2019-11859 · Jenkins · Jenkins Deploy Weblogic Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Deploy WebLogic Plugin affected versions not specified Description: The issue is related to a missing permission check in the Jenkins Deploy WebLogic Plugin. This allows attackers with Overall/Read permission to connect to an...