PT-2019-11388 · Jenkins · Jenkins Openid Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins openid Plugin affected versions not specified Description: A cross-site request forgery issue exists in the OpenIdSsoSecurityRealm.DescriptorImpldoValidate form validation method, allowing attackers to initiate a connection to an...

PT-2019-11693 · Jenkins · Jenkins Netsparker Cloud Scan Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins Netsparker Cloud Scan Plugin version 1.1.5 and older Jenkins Netsparker Enterprise Scan Plugin affected versions not specified Description: The issue concerns the storage of sensitive information in plain text within configuration fil...

PT-2019-11352 · Jenkins · Jenkins Aws Cloudwatch Logs Publisher Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins AWS CloudWatch Logs Publisher Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins master or controller...

PT-2019-11680 · Jenkins · Jenkins Jenkins-Reviewbot Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins jenkins-reviewbot Plugin affected versions not specified Description: A cross-site request forgery issue exists in the ReviewboardDescriptordoTestConnection form validation method, allowing attackers to initiate a connection to an...

PT-2019-11691 · Jenkins · Jenkins Netsparker Cloud Scan Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Netsparker Cloud Scan Plugin version 1.1.5 and older Description: A cross-site request forgery issue exists in the NCScanBuilder.DescriptorImpldoValidateAPI form validation method, allowing attackers to initiate a connection to an...

PT-2019-11360 · Jenkins · Veracode Scan Jenkins Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins veracode-scanner Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file of the Jenkins veracode-scanner Plugin, specifically in t...

Open STF Plugin stores credentials in plain text

Open STF Plugin stores credentials unencrypted in its global configuration file hudson.plugins.openstf.STFBuildWrapper.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

Jenkins Plugin v2 for Qualys WAS Now Available

We are pleased to announce that the Qualys WAS Jenkins plugin v2 is now available. This version of the plugin introduces new features to facilitate automation, and a more user-friendly design. What's New? Whereas the previous release of the plugin supported only Jenkins "pipeline" projects, the n...

CloudBees Jenkins Job Import Plugin XML External Entity Injection Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Job Import Plugin is used in one of the...

CloudBees Jenkins JUnit Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the U.S. CloudBees set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and a number of timed tasks . JUnit Plugin is used in one of the Java...

CloudBees Jenkins Git Changelog Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. that are used to monitor ongoing software releases/testing projects and some timed tasks.The Git Changelog Plugin is one of the tools used to create a changelog or release note...

Jenkins ACL Bypass and Metaprogramming RCE

This module exploits a vulnerability in Jenkins dynamic routing to bypass the Overall/Read ACL and leverage Groovy metaprogramming to download and execute a malicious JAR file. When the "Java Dropper" target is selected, the original entry point based on classLoader.parseClass is used, which...

org.jenkins-ci.plugins:mesos (>=0.11.0, <=0.13.1) potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.27.0)

org.apache.mesos:mesos MAVEN version 0.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - org.jenkins-ci.plugins:mesos =0.11.0, =0.13.1 Source cves: CVE-2018-8023 Source advisory: OSV:GHSA-C8CC-P3J7-4C7F...

DependencyCheck v3.3.1 - A Software Composition Analysis Utility That Detects Publicly Disclosed Vulnerabilities In Application Dependencies

Dependency-Check is a Software Composition Analysis SCA tool that attempts to detect publicly disclosed vulnerabilities contained within a project's dependencies. It does this by determining if there is a Common Platform Enumeration CPE identifier for a given dependency. If found, it will generat...

CloudBees Jenkins SSH Agent Plugin Information Disclosure Vulnerability

CloudBees Jenkins is the U.S. CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and a number of timed tasks . SSH Agent Plugin is used in one of the plug-ins used to provi...

com.openshift.jenkins:openshift-pipeline (>=1.0.22, <=1.0.57), io.fabric8.jenkins.plugins:openshift-sync (>=0.0.8, <=1.0.42) potentially affected by CVE-2018-1999040 via org.csanchez.jenkins.plugins:kubernetes (>=0.6, <=0.10)

org.csanchez.jenkins.plugins:kubernetes MAVEN version =0.6, =1.0.22, =0.0.8, =1.0.42 Source cves: CVE-2018-1999040 Source advisory: MEND:CVE-2018-1999040...

CVE-2017-2650

It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commit access, as well as users with e.g. Job/Configure permission in Jenkins...

CVE-2017-2650: DEPRECATED: Authentication Bypass Issues

It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commit access, as well as users with e.g. Job/Configure permission in Jenkins...

CloudBees Jenkins Fortify CloudScan Plugin Arbitrary File Write Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , which is mainly used to monitor the continuous software release/testing projects and some of the timed execution of the task . Fortify CloudScan...

AWS CodePipeline Plugin stored AWS Secret Key in plain text

AWS CodePipeline Plugin stored the AWS Secret Key in its configuration unencrypted in jobs' config.xml files on the Jenkins controller. This key could be viewed by users with Extended Read permission, or access to the Jenkins controller file system. While masked from view using a password form...