GHSA-XXRG-MG63-QFPJ Jenkins AnchorChain Plugin Has a Cross-Site Scripting (XSS) Vulnerability

Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the javascript: scheme. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control the input file for the Anchor Chain post-build step...

GHSA-2X3G-RR4W-4QRP Jenkins Zoho QEngine Plugin Displays Unmasked API Keys

Jenkins Zoho QEngine Plugin 1.0.29.vfacc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it...

Jenkins Zoho QEngine Plugin Displays Unmasked API Keys

Jenkins Zoho QEngine Plugin 1.0.29.vfacc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it...

CVE-2025-30196

CVE-2025-30196 concerns Jenkins AnchorChain Plugin 1.0. The vulnerability arises because the plugin does not restrict URL schemes in links created from workspace content, allowing the javascript: scheme and enabling stored XSS when an attacker can control the input file for the Anchor Chain post-...

jenkins-plugin/script-security: Jenkins Script Security Plugin File Disclosure Vulnerability

A flaw was found in the Jenkins Script Security Plugin. This vulnerability allows attackers with Overall/Read permission to check for the existence of files on the controller file system via a method that implements form validation that does not perform a permission check...

GHSA-4352-JXWG-88RM Jenkins Zoom Plugin is Missing Password Field Masking

Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of information via adjacent network access...

CVE-2025-0148

Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of information via adjacent network access...

CVE-2025-0148

CVE-2025-0148 (Zoom Jenkins Marketplace plugin) : A defect in the Zoom Jenkins Marketplace plugin up to version 1.6 allows information disclosure due to missing password field masking, exploitable by an unauthenticated actor via adjacent network access. Vulnerable component: Zoom Jenkins Marketpl...

CVE-2025-0148 Zoom Jenkins Marketplace plugin - Missing Password Field Masking

Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of information via adjacent network access...

GHSA-JX45-XP6Q-CWJC Jenkins Zoom Plugin Stores Sensitive Information in Cleartext

Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of information via network access...

CVE-2025-0142 Zoom Jenkins Marketplace plugin - Cleartext Storage of Sensitive Information

Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of information via network access...

CVE-2025-0142

The CVE-2025-0142 entry concerns the Zoom Jenkins Marketplace plugin. It describes cleartext storage of sensitive information in versions before 1.4, enabling an authenticated user to disclose information over the network. Affected component: Zoom Jenkins Marketplace plugin (pre-1.4). Root cause:...

Zoom Jenkins Marketplace plugin 安全漏洞

Zoom Jenkins Marketplace plugin is a plugin from Zoom USA. A security vulnerability exists in Zoom Jenkins Marketplace plugin versions prior to 1.4 that originates from storing sensitive information in plaintext. An attacker can exploit the vulnerability to disclose sensitive information...

PT-2025-3751

Name of the Vulnerable Software and Affected Versions Zoom Jenkins Marketplace plugin version 1.3 and earlier Description The issue concerns the storage of sensitive information in cleartext within the Zoom Jenkins Marketplace plugin. This may allow an authenticated user to disclose information v...

GHSA-WH3H-J8WP-6P42 CSRF vulnerability in Jenkins Azure Service Fabric Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a Service Fabric URL using attacker-specified credentials IDs obtained through another method...

CVE-2025-24402

A cross-site request forgery CSRF vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a Service Fabric URL using attacker-specified credentials IDs obtained through another method...

CVE-2025-24403

A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of Azure credentials stored in Jenkins...

CVE-2025-24401

Jenkins Folder-based Authorization Strategy Plugin 217.vd5b18537403e and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted typically optional permissions, like Overall/Manage to access functionality they're no longer entitle...

CVE-2025-24403

A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of Azure credentials stored in Jenkins...

CVE-2025-24402

A cross-site request forgery CSRF vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a Service Fabric URL using attacker-specified credentials IDs obtained through another method...