2464 matches found
Server-side request forgery vulnerability in URLTrigger Plugin
A form validation method in URLTrigger Plugin did not check the permission of the user accessing them, allowing anyone with Overall/Read access to Jenkins to cause Jenkins to send a GET request to a specified URL. Additionally, this form validation method did not require POST requests, resulting ...
CloudBees Jenkins GitHub Plugin Information Disclosure Vulnerability
CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . GitHub Plugin is used in one of the...
org.jenkins-ci.plugins:vectorcast-execution (>=0.16, <=0.61) potentially affected by CVE-2018-1000202 via org.jvnet.hudson.plugins:groovy-postbuild (2.3)
org.jvnet.hudson.plugins:groovy-postbuild MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jvnet.hudson.plugins:groovy-postbuild and may be impacted: - org.jenkins-ci.plugins:vectorcast-execution =0.16, =0.61 Source cves:...
CSRF vulnerability and missing permission checks in Black Duck Hub Plugin allowed server-side request forgery, capturing credentials
Black Duck Hub Plugin did not perform permission checks on methods implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...
CloudBees Jenkins S3 Plugin Cross-Site Scripting Vulnerability
CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version release/testing projects and some timed tasks . S3 Plugin is used in one of the...
Perforce Plugin uses ineffective credentials encryption
Perforce Plugin encrypts its credentials using DES and an encryption key stored in its public source code, so it only serves as basic obfuscation. This allowed users with Jenkins controller local file system access and Jenkins administrators to retrieve the stored password. The latter could resul...
Coverity Plugin stored keystore and private key passwords in plain text
The Coverity Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins controller local file system access and Jenkins administrators to retrieve the stored password. The latter could result in exposure of the passwords through browser extensions, cross-sit...
Disclosure of user names and node names to unauthorized users through post-commit hook URL in Subversion Plugin
The class handling unauthenticated Subversion post-commit hook notification requests at the /subversion/ path unnecessarily extended another type that handled requests to the …/search/ sub-path. This allowed submission of search queries to Jenkins, and getting a list of search results usually...
OWASP DependencyCheck - A Software Composition Analysis Utility That Detects Publicly Disclosed Vulnerabilities In Application Dependencies
Dependency-Check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration CPE identifier for a given dependency. If found, it will generate a report linking to the associate...
DEBIAN-CVE-2017-7550
A flaw was found in the way Ansible 2.3.x before 2.3.3, and 2.4.x before 2.4.1 passed certain parameters to the jenkinsplugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in th...
PYSEC-2017-4
A flaw was found in the way Ansible 2.3.x before 2.3.3, and 2.4.x before 2.4.1 passed certain parameters to the jenkinsplugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in th...
UBUNTU-CVE-2017-7550
A flaw was found in the way Ansible 2.3.x before 2.3.3, and 2.4.x before 2.4.1 passed certain parameters to the jenkinsplugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in th...
CVE-2017-7550
A flaw was found in the way Ansible 2.3.x before 2.3.3, and 2.4.x before 2.4.1 passed certain parameters to the jenkinsplugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in th...
PT-2017-17794
Name of the Vulnerable Software and Affected Versions Ansible versions 2.3.x through 2.3.2 Ansible versions 2.4.x through 2.4.0 Description A flaw was found in the way Ansible passed certain parameters to the jenkins plugin module, allowing remote attackers to expose sensitive information from a...
OWASP ZAP 2.6.0 - Penetration Testing Tool for Testing Web Applications
The OWASP Zed Attack Proxy ZAP is one of the world’s most popular free security tools and is actively maintained by hundreds of international volunteers. It can help you automatically find security vulnerabilities in your web applications while you are developing and testing your applications. It...
[SECURITY] Fedora 24 Update: jenkins-junit-plugin-1.12-1.fc24
This package provides Jenkins plugin which allows JUnit-format test results to be published...
[SECURITY] Fedora 21 Update: jenkins-matrix-project-plugin-1.4-3.fc21
This package provides Jenkins plugin which adds support for Multi-configuration matrix project type...
[SECURITY] Fedora 21 Update: jenkins-icon-shim-1.0.4-1.fc21
A "shim" plugin that allows plugins make use of the core icon tag, while still remaining backward compatible with older versions of Jenkins core that do not have the icon tag...