CVE-2023-37953: Missing Authorization

A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2023-37944: Missing Authorization

A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2023-37965: Missing Authorization

A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

PT-2023-26203

Name of the Vulnerable Software and Affected Versions Jenkins Test Results Aggregator Plugin versions 1.2.13 and earlier Description A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials. This issue arises...

CVE-2023-37963: Missing Authorization

A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system...

CVE-2023-37945: Missing Authorization

A missing permission check in Jenkins SAML Single Sign OnSSO Plugin 2.1.0 through 2.3.0 both inclusive allows attackers with Overall/Read permission to download a string representation of the current security realm...

PT-2023-26193

Name of the Vulnerable Software and Affected Versions Jenkins SAML Single Sign OnSSO Plugin versions 2.1.0 through 2.3.0 Description A missing permission check in the Jenkins SAML Single Sign OnSSO Plugin allows attackers with Overall/Read permission to download a string representation of the...

CVE-2023-37956: Missing Authorization

A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...

Missing permission check in datadog allows capturing credentials

datadog 5.4.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. datadog...

Missing permission check in macstadium-orka allows capturing credentials

macstadium-orka 1.33 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CSRF vulnerability and missing permission checks in sumologic-publisher

sumologic-publisher 2.2.1 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additionally, this form validation method does not require POST requests, resulting in a...

CSRF vulnerability and missing permission check in test-results-aggregator

test-results-aggregator 1.2.13 and earlier does not perform a permission check in an HTTP endpoint implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally, this HTTP...

CSRF vulnerability and missing permission checks in benchmark-evaluator

benchmark-evaluator 1.0.1 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins...

CVE-2023-37959: Missing Authorization

A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

PT-2023-26207

Name of the Vulnerable Software and Affected Versions Jenkins Sumologic Publisher Plugin versions 2.2.1 and earlier Description A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL. This issue also results in a cross-site...

PT-2023-26206

Name of the Vulnerable Software and Affected Versions Jenkins Sumologic Publisher Plugin versions 2.2.1 and earlier Description A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL. The issue arises from a lack of permission check in a method...

PT-2023-26192 · Jenkins · Jenkins Datadog Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Datadog Plugin versions 5.4.1 and earlier Description: A missing permission check in the Jenkins Datadog Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...

Missing permission check in mabl-integration allows enumerating credentials IDs

mabl-integration 0.0.46 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

CVE-2023-35149

A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins...

CVE-2023-3315

Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system...