CVE-2025-53650

Jenkins Credentials Binding Plugin 687.v619cb15e923f and earlier does not properly mask i.e., replace with asterisks credentials present in exception error messages that are written to the build log...

CVE-2025-53652

Jenkins Git Parameter Plugin 439.vb0e46ca14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered choices, allowing attackers with Item/Build permission to inject arbitrary values into Git parameters...

CVE-2025-53654

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

CVE-2025-53655

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it...

CVE-2025-53743

The Jenkins Applitools Eyes Plugin (version 1.16.5 and earlier ) contains an Insufficiently Protected Credentials vulnerability. The plugin fails to mask Applitools API keys on the job configuration form, potentially allowing attackers to observe and capture sensitive credentials. Additionally, k...

CVE-2025-53742

Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2025-53678

Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

CVE-2025-53676

The Jenkins Xooa Plugin (version 0.0.7 and earlier ) is vulnerable to Credential Exposure due to a CWE-311 flaw. The plugin stores the Xooa Deployment Token unencrypted within the global configuration file (specifically io.jenkins.plugins.xooa.GlobConfig.xml) on the Jenkins controller. This allow...

CVE-2025-53673

The Jenkins Sensedia Api Platform tools Plugin 1.0 is vulnerable to Cleartext Storage of Sensitive Information . The plugin stores the Sensedia API Manager integration token unencrypted in the global configuration file com.sensedia.configuration.SensediaApiConfiguration.xml on the Jenkins control...

CVE-2025-53674

The Jenkins Sensedia Api Platform tools Plugin 1.0 is vulnerable to insufficient credential protection because it fails to mask the Sensedia API Manager integration token on the global configuration form. Additionally, the token is stored in unencrypted form within the file com.sensedia.configura...

CVE-2025-53674

Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, increasing the potential for attackers to observe and capture it...

CVE-2025-53673

Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

CVE-2025-53671

Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53671

Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53670

The Jenkins Nouvola DiveCloud Plugin (version 1.08 and earlier ) is vulnerable to Credential Exposure because it stores DiveCloud API Keys and Credentials Encryption Keys in unencrypted plain text within the config.xml files on the Jenkins controller. An attacker with Item/Extended Read permissio...

CVE-2025-53668

The Jenkins VAddy Plugin (version 1.2.8 and earlier) stores Vaddy API Auth Keys unencrypted in the job config.xml files on the Jenkins controller. Due to this CWE-311 (Missing Encryption of Sensitive Data) flaw, users with Item/Extended Read permissions or those with direct access to the Jenkins ...

CVE-2025-53669

Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53667

The Jenkins Dead Man's Snitch Plugin 0.1 is vulnerable to Insufficiently Protected Credentials (CWE-522) because it fails to mask sensitive tokens on the job configuration form. Additionally, tokens are stored in an unencrypted form within the config.xml file. An attacker can observe these expose...

CVE-2025-53667

Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53665

The Jenkins Apica Loadtest Plugin (version 1.10 and earlier) is vulnerable to insecure credential handling. The plugin stores Apica Loadtest LTP authentication tokens unencrypted in plaintext within the config.xml files on the Jenkins controller. Additionally, the plugin fails to mask these token...