Design/Logic Flaw

Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10281

Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-1003088

Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-1003088

The CVE-2019-1003088 entry concerns Jenkins Fabric Beta Publisher Plugin. The provided documents indicate that the plugin stores credentials unencrypted in job config.xml files on the Jenkins master, allowing credential access by users with Extended Read permission or anyone with access to the ma...

CVE-2019-1003067

CVE-2019-1003067 describes a credential exposure in the Jenkins Trac Publisher Plugin where credentials are stored in plaintext in job config.xml on the Jenkins master/controller. The root cause is unencrypted credential storage in the plugin’s configuration files, making credentials viewable by ...

CVE-2019-1003059

A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpldoLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

CVE-2019-1003058

CVE-2019-1003058 describes a Cross-Site Request Forgery vulnerability in the Jenkins FTP Publisher Plugin, specifically in FTPPublisher.DescriptorImpl#doLoginCheck. The flaw allows an attacker to induce the Jenkins server to initiate a connection to an attacker-specified server. The linked connec...

CVE-2019-1003062

Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-1003059

The CVE-2019-1003059 entry concerns Jenkins FTP Publisher Plugin. The vulnerability is a missing permission check in FTPPublisher.DescriptorImpl#doLoginCheck, which allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server. Affected component is the Je...

CVE-2019-1003067

Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-1003067

Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-1003052

Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-1003052

CVE-2019-1003052 affects the Jenkins AWS Elastic Beanstalk Publisher Plugin. The credential data is stored in plaintext in the plugin’s global configuration file on the Jenkins master/controller (org.jenkinsci.plugins.awsbeanstalkpublisher.AWSEBPublisher.xml), allowing any user with master filesy...

CVE-2019-1003088: Missing Encryption of Sensitive Data

Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-1003058: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpldoLoginCheck method allows attackers to initiate a connection to an attacker-specified server...

CVE-2019-1003059: Missing Authorization

A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpldoLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

CVE-2019-10281: Insufficiently Protected Credentials

Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

PT-2019-11683 · Jenkins · Jenkins Relution Enterprise Appstore Publisher Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Relution Enterprise Appstore Publisher Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins master or controller...

CVE-2019-1003052: Missing Encryption of Sensitive Data

Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-1003067: Missing Encryption of Sensitive Data

Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...