Credential Exposure

Overview Affected versions of this package are vulnerable to Credential Exposure due to the storage of sensitive credentials in plaintext within the global configuration file on the controller file system. An attacker can obtain confidential information by gaining access to the file system...

CVE-2025-53655: Plaintext Storage of a Password

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it...

CVE-2025-53662: Plaintext Storage of a Password

Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2025-53675: Plaintext Storage of a Password

Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2025-53677: Plaintext Storage of a Password

Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to observe and capture it...

CVE-2025-53665: Plaintext Storage of a Password

Jenkins Apica Loadtest Plugin 1.10 and earlier does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53671: Plaintext Storage of a Password

Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53674: Plaintext Storage of a Password

Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, increasing the potential for attackers to observe and capture it...

CVE-2025-53664: Plaintext Storage of a Password

Jenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2025-53656: Plaintext Storage of a Password

Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file...

CVE-2025-53669: Plaintext Storage of a Password

Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53660: Plaintext Storage of a Password

Jenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

Plaintext security passwords are logged in the audit logs while executing openssl cmd (CVE-2025-4662)

Brocade SANnav before SANnav 2.4.0a logs plaintext passphrases in the Brocade SANnav host server audit logs while executing OpenSSL command using a passphrase from the command line or while providing the passphrase through a temporary file. These audit logs are the local server VM’s audit logs an...

Polyadic Encryption

A novel original procedure of encryption/decryption based on the polyadic algebraic structures and on signal processing methods is proposed. First, we use signals with integer amplitudes to send information. Then we use polyadic techniques to transfer the plaintext into series of special integers...

PT-2025-29164

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.4.0a Description: Brocade SANnav logs plaintext passphrases in the host server audit logs when executing an OpenSSL command using a passphrase from the command line or through a temporary file. These audit...

CVE-2025-34078

A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file nsclient.ini stores the administrative password in plaintext and is readable by local users. By extracting this password, an attack...

CVE-2025-6224

Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it...

CVE-2025-1709 CVE-2025-1709

Several credentials for the local PostgreSQL database are stored in plain text partially base64 encoded...

Sensitive Data Exposure

github.com/juju/utils is vulnerable to Sensitive Data Exposure. The vulnerability is due to the cert.NewLeaf function generating certificates that may contain private key information, which allows an attacker to extract the private key if the certificate is transmitted over the network in plainte...

Wire Swiss wire-ios 安全漏洞

Wire Swiss wire-ios is an iOS application from Wire Swiss open source. A security vulnerability exists in Wire Swiss wire-ios versions prior to 3.111.1 through 3.124.1, which originates from messages being logged in plaintext to the iOS system log, potentially leading to information disclosure...