CVE-2019-10449

Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10449

CVE-2019-10449 affects Jenkins Fortify on Demand Plugin, where credentials are stored in plaintext in the Jenkins master’s job config.xml. This allows users with Extended Read permission or those with access to the master filesystem to view sensitive credentials. The vulnerability is documented a...

CVE-2019-10447

Jenkins Sofy.AI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10443

Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10440

Jenkins NeoLoad Plugin 2.2.5 and earlier stored credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

PT-2019-11846 · Jenkins · Jenkins View26 Test-Reporting Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins View26 Test-Reporting Plugin affected versions not specified Description: The issue concerns the storage of sensitive information in an unencrypted manner. Specifically, the Jenkins View26 Test-Reporting Plugin stores credentials and ...

PT-2019-11843 · Jenkins · Jenkins Fortify On Demand Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Fortify on Demand Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within job config.xml files on the Jenkins master or controller. These credentials can be...

PT-2019-11841 · Jenkins · Jenkins Sofy.Ai Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Sofy.AI Plugin affected versions not specified Description: The issue concerns the storage of sensitive information by the Jenkins Sofy.AI Plugin. Specifically, it stores credentials and an API token unencrypted in job config.xml file...

WordPress job-manager plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. job-manager is a recruitment/job search plugin used in it. A cross-site scripting vulnerability exists in the WordPress job-manager...

Release Information for Veeam Availability for Nutanix AHV 1.0 Update 3

Challenge Release Notes for Veeam Availability for Nutanix AHV 1.0 Update 3. This update supersedes Veeam Availability for Nutanix AHV 1.0 Update 2. Solution Veeam Availability for Nutanix AHV 1.0 Update 3 includes improvements and fixes for series of issues. The most critical ones are listed...

Beware of Fall Phishing Season

A recent blog post by LinkedIn says there are more available job postings listed in October than any other month. Since 89% of the hiring managers who spoke to LinkedIn said it takes less than four weeks to fill those roles, there is a limited window of opportunity - for both job seekers and...

How Tortoiseshell created a fake veteran hiring website to host malware

By Warren Mercer and Paul Rascagneres with contributions from Jungsoo An. Introduction Cisco Talos recently discovered a threat actor attempting to take advantage of Americans who may be seeking a job, especially military veterans. The actor, previously identified by Symantec as Tortoiseshell,...

Cross-Site Scripting (XSS)

dolibarr/dolibarr is vulnerable to cross-site scripting XSS. The vulnerability exists due to the use of alpha instead of nohtml in card.php, allowing a remote attacker to inject arbitrary Javascript into a victim's browser via the job parameter...

[SECURITY] Fedora 31 Update: glpi-9.4.4-1.fc31

GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...

CVE-2019-10435

Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure...

CVE-2019-10433

Jenkins Dingding钉钉 Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10433

Jenkins Dingding钉钉 Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

Design/Logic Flaw

Jenkins Dingding?? Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

Code injection

Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure...

CVE-2019-10435

Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure...