CVE-2025-53742

Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2025-53671

The Jenkins Nouvola DiveCloud Plugin (version 1.08 and earlier ) contains a vulnerability where DiveCloud API Keys and Credentials Encryption Keys are not masked when displayed on the job configuration form. This lack of protection allows an attacker to observe and capture sensitive authenticatio...

CVE-2025-53669

The Jenkins VAddy Plugin (version 1.2.8 and earlier ) fails to mask Vaddy API Auth Keys when they are displayed on the job configuration form. This oversight allows attackers to observe and capture sensitive credentials directly from the user interface. Additionally, the plugin stores these keys ...

CVE-2025-53669

Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53667

The Jenkins Dead Man's Snitch Plugin 0.1 is vulnerable to Insufficiently Protected Credentials (CWE-522) because it fails to mask sensitive tokens on the job configuration form. Additionally, tokens are stored in an unencrypted form within the config.xml file. An attacker can observe these expose...

CVE-2025-53667

Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53667

Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53665

Jenkins Apica Loadtest Plugin 1.10 and earlier does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53662

Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2025-53662

Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2025-53661

Jenkins Testsigma Test Plan run Plugin 1.6 and earlier does not mask Testsigma API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53661

The Jenkins Testsigma Test Plan run Plugin (version 1.6 and earlier ) contains a vulnerability where Testsigma API keys are not masked when displayed on the job configuration form. While these keys are stored encrypted on the Jenkins controller's config.xml file, the lack of masking in the web in...

CVE-2025-53659

The Jenkins QMetry Test Management Plugin (version 1.13 and earlier) is vulnerable to Credential Exposure because it stores Qmetry Automation API Keys unencrypted in the config.xml files on the Jenkins controller. Attackers with Item/Extended Read permissions or direct access to the controller's ...

CVE-2025-53657

Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier does not mask SLM License Access Keys, client secrets, and passwords displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

PT-2025-28913 · Jenkins · Jenkins Testsigma Test Plan Run Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Testsigma Test Plan run Plugin versions 1.6 and earlier Description: The Jenkins Testsigma Test Plan run Plugin does not mask Testsigma API keys displayed on the job configuration form. This increases the potential for attackers to...

CVE-2025-53671: Plaintext Storage of a Password

Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53743: Insufficiently Protected Credentials

Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53667: Insufficiently Protected Credentials

Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53669: Plaintext Storage of a Password

Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53661: Insufficiently Protected Credentials

Jenkins Testsigma Test Plan run Plugin 1.6 and earlier does not mask Testsigma API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...