jenkinsci__perfecto-plugin_CVE-2020-2261_1-17

Perfecto Jenkins Plugin Perfecto Jenkins Plugin은 빌드 환경에서 Perfecto Connect 터널 ID를 자동 생성하거나 기존 터널 ID를 재사용할 수 있는 기능을 제공합니다. 목차 Perfecto Jenkins Plugin 목차 전제 조건 1. 플러그인 활성화 단계 스크린샷 Mac Windows 고급 옵션 2. 사용법 Maven 샘플 Gradle 샘플 3. Perfecto Connect 중지 단계 고급 사용법 Perfecto Connect 파이프라인 샘플 perfecto에 앱 업로드...

EUVD-2015-4394

Malware in sbrugna...

EUVD-2022-3610

Malicious code in bioql PyPI...

EUVD-2022-2185

Malicious code in bioql PyPI...

GHSA-JQ84-6FMM-6QV6 OS command execution vulnerability in Perfecto Plugin

Perfecto Plugin allows specifying Perfecto Connect Path and Perfecto Connect File Name in job configurations. This command is executed on the Jenkins controller in Perfecto Plugin 1.17 and earlier, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controlle...

OS command execution vulnerability in Perfecto Plugin

Perfecto Plugin allows specifying Perfecto Connect Path and Perfecto Connect File Name in job configurations. This command is executed on the Jenkins controller in Perfecto Plugin 1.17 and earlier, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controlle...

Missing permission check in Perfecto Plugin

Perfecto Plugin 1.17 and earlier does not perform a permission check in a method implementing a connection test. This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified username and password. Perfecto Plugin 1.18 requires...

GHSA-3H2Q-M63Q-9CF6 Missing permission check in Perfecto Plugin

Perfecto Plugin 1.17 and earlier does not perform a permission check in a method implementing a connection test. This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified username and password. Perfecto Plugin 1.18 requires...

GHSA-CQ9M-RPM5-27M9 Jenkins Perfecto Mobile Plugin stores credentials in plain text

Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

Jenkins Perfecto Mobile Plugin stores credentials in plain text

Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CloudBees Jenkins Perfecto Arbitrary Command Execution Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . Jenkins Perfecto plugin versi...

CloudBees Jenkins Perfecto Privilege Control Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A privilege control...

CVE-2020-2261

Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller...

CVE-2020-2260

A missing permission check in Jenkins Perfecto Plugin 1.17 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials...

CVE-2020-2260

A missing permission check in Jenkins Perfecto Plugin 1.17 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials...

CVE-2020-2261

Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller...

Design/Logic Flaw

A missing permission check in Jenkins Perfecto Plugin 1.17 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials...

Command injection

Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller...

CVE-2020-2261

Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller...

CVE-2020-2261

CVE-2020-2261 concerns the Jenkins Perfecto Plugin (versions ≤ 1.17). The issue allows users with Job/Configure permission to cause arbitrary commands to run on the Jenkins controller by how the plugin handles Perfecto Connect Path/File Name in job configurations. The root cause is execution of a...