1218 matches found
CVE-2023-40340
Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask i.e., replace with asterisks credentials specified in the Npm config file in Pipeline build logs...
CVE-2023-40340
Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask i.e., replace with asterisks credentials specified in the Npm config file in Pipeline build logs...
CVE-2023-40340
Summary of CVE-2023-40340: The Jenkins NodeJS Plugin (versions ≤ 1.6.0) fails to mask credentials in the Npm config file as they appear in Pipeline build logs. This improper masking can expose credentials, per the Red Hat and NVD entries, which align on the affected plugin and version range. The ...
CVE-2023-40339: Undefined Security Weakness
Jenkins Config File Provider Plugin 952.va544a6234b46 and earlier does not mask i.e., replace with asterisks credentials specified in configuration files when they're written to the build log...
PT-2023-5741 · Jenkins · Jenkins Nodejs Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins NodeJS Plugin versions 1.6.0 and earlier Description: The issue is related to the improper masking of credentials in the Npm config file in Pipeline build logs. This could allow a remote attacker to gain unauthorized access to protect...
CVE-2023-40340: Undefined Security Weakness
Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask i.e., replace with asterisks credentials specified in the Npm config file in Pipeline build logs...
Improper masking of credentials in config-file-provider
config-file-provider 952.va544a6234b46 and earlier does not mask i.e., replace with asterisks credentials specified in configuration files when they're written to the build log. config-file-provider 953.v0432a802e4d2 masks credentials configured in configuration files if they appear in the build...
Improper masking of credentials in nodejs
nodejs integrates with https://plugins.jenkins.io/config-file-provider/Config File Provider Plugin to specify custom NPM settings, including credentials for authentication, in a Npm config file. nodejs 1.6.0 and earlier does not properly mask i.e., replace with asterisks credentials specified in...
CVE-2023-39155
Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it...
CVE-2023-39152
Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked i.e., replaced with asterisks in the build log in some circumstances...
PT-2023-26809 · Jenkins · Jenkins Gradle Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Gradle Plugin version 2.8 Description: The issue is related to an always-incorrect control flow implementation that may result in credentials not being masked in the build log under certain circumstances. Recommendations: For Jenkins...
Incorrect control flow in gradle breaks credentials masking in the build log
gradle 2.8 improperly invokes APIs available only on the controller from an agent when setting up build log annotations, causing an exception. As a result, credentials may not be masked i.e., replaced with asterisks in the build log in some circumstances. gradle 2.8.1 improves the control flow an...
CVE-2023-3417
Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...
Information Disclosure
gitlab is vulnerable to Information Disclosure. The vulnerability exists because the missing input masking in the library, allowing an attacker to gain sensitive information in the integration properties of the web interface...
The vulnerability of the OpenSearch software package, related to incorrect authorization, allows a perpetrator to introduce incorrect access authorization.
The vulnerability of the OpenSearch software package is related to the implementation of detailed access control rules document level security, field level security, and field masking. These rules were incorrectly applied to queries under rare execution conditions. Exploiting this vulnerability c...
ROS-20230615-02
The vulnerability of the OpenSearch software package is related to the implementation of detailed access control rules document-level security, field-level security, and field masking when they were incorrectly applied to queries during extremely rare runtime conditions. Exploitation of the of th...
Mitsubishi Electric MELSEC iQ-R Series/iQ-F Series (Update C)
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION : Exploitable remotely/low attack complexity Vendor : Mitsubishi Electric Equipment : MELSEC iQ-R Series/iQ-F Series EtherNet/IP Modules and EtherNet/IP Configuration Tool Vulnerabilities: Weak Password Requirements, Use of Hard-coded Credentials, Missin...
PT-2023-3094 · Mitsubishi · Melsec Iq-R Series Ethernet/Ip Module Rj71Eip91 +3
Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP Description: The issue is related to...
CVE-2023-33955
CVE-2023-33955 affects MinIO Console (UI for MinIO Object Storage). Vulnerability arises from Unicode RIGHT-TO-LEFT OVERRIDE characters used to mask the original filename, enabling information exposure. Root cause is improper handling of such filenames in the MinIO Console prior to the fix. The i...