CVE-2026-59327 Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

EUVD-2024-32201

Malicious code in bioql PyPI...

CVE-2024-3622 Mirror-registry: plain-text default csrf secret key

A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same secret key. This flaw allows a...

CVE-2024-3622

CVE-2024-3622 affects Quay deployments using mirror-registry, where a default secret is stored in plain-text in a configuration template. This enables an attacker to craft session cookies and potentially gain access to the affected Quay instance. The vulnerability is rooted in the reuse of the sa...

PT-2024-3592

Name of the Vulnerable Software and Affected Versions Quay affected versions not specified Description A flaw was found in Quay when using mirror-registry to install it, where a default database secret key is used and stored in plain-text format in a configuration template file. This issue may le...

Client secret stored and displayed in plain text by wso2id-oauth

wso2id-oauth 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller as part of its configuration. This client secret can be viewed by users with access to the Jenkins controller file system. Additionally, the global configuration fo...

Secret stored in plain text by Parameterized-Remote-Trigger

Parameterized-Remote-Trigger 3.1.3 and earlier stores a secret unencrypted in its global configuration file org.jenkinsci.plugins.ParameterizedRemoteTrigger.RemoteBuildConfiguration.xml on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with access to t...

Secret stored in plain text by github-coverage-reporter

github-coverage-reporter 1.8 and earlier stores a GitHub access token in plain text in its global configuration file io.jenkins.plugins.gcr.PluginConfiguration.xml. This token can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no...

AWS CodeBuild Plugin stored AWS Secret Key in plain text

AWS CodeBuild Plugin stored the AWS Secret Key in its configuration unencrypted in jobs' config.xml files on the Jenkins controller. This key could be viewed by users with Extended Read permission, or access to the Jenkins controller file system. While masked from view using a password form field...

AWS CodeDeploy Plugin stored AWS Secret Key in plain text

AWS CodeDeploy Plugin stored the AWS Secret Key in its configuration unencrypted in jobs' config.xml files and its global configuration file on the Jenkins controller. This key could be viewed by users with Extended Read permission, or access to the Jenkins controller file system. While masked fr...