Missing permission check allowed connecting to RabbitMQ in Rabbit-MQ Publisher Plugin

A missing permission check in a form validation method of Rabbit-MQ Publisher Plugin allowed users with Overall/Read access to have Jenkins initiate a RabbitMQ connection to an attacker-specified host and port with an attacker-specified username and password. Additionally, this form validation...

Rabbit-MQ Publisher Plugin stored password in plain text

Rabbit-MQ Publisher Plugin stored the username and password in its configuration unencrypted in its global configuration file on the Jenkins controller. This password could be viewed by users with access to the Jenkins controller file system. The plugin now stores the password encrypted in the...

SolarWinds Orion Platform Elevation of Privilege Vulnerability

SolarWinds Orion Platform is a network fault and network performance management platform from SolarWinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user opinions, and a mapped view of the entire network. A...

CVE-2019-9546

SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service...

Design/Logic Flaw

SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service...

CVE-2019-9546

SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service...

CVE-2019-9546

SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service...

CVE-2019-9546

SolarWinds Orion Platform prior to 2018.4 Hotfix 2 contains a privilege escalation vulnerability exploitable through the RabbitMQ service. Affected component is Orion Platform with RabbitMQ integration; root cause involves elevation of privileges (unrestricted access via RabbitMQ) that can lead t...

PT-2019-19697

Name of the Vulnerable Software and Affected Versions SolarWinds Orion Platform versions prior to 2018.4 Hotfix 2 Description The issue allows for privilege escalation through the RabbitMQ service. Recommendations For versions prior to 2018.4 Hotfix 2, update to 2018.4 Hotfix 2 or later to resolv...

CVE-2019-9546: Uncontrolled Search Path Element

SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service...

CVE-2019-9546

SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

Denial Of Service (DoS)

RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker. Security Fixes: A resource-consumption flaw was found in RabbitMQ Server, where the lengthsage or lengthsincr...

Cross-site Scripting (XSS)

rabbitmq-server is vulnerable to cross-site scripting XSS attacks. The vulnerability exists in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error...

CVE-2018-16879

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting...

CVE-2018-16879

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting...

Default configuration

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting...

CVE-2018-16879

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting...

CVE-2018-16879

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting...

CVE-2018-16879

CVE-2018-16879 affects Ansible Tower 3.x prior to 3.3.3. The issue is a RabbitMQ misconfiguration where a secure channel is not used for messaging celery workers, enabling potential data leakage of sensitive information (e.g., passwords) and denial-of-service actions such as deletion of projects ...

PT-2019-9380 · Red Hat · Ansible Tower

Name of the Vulnerable Software and Affected Versions: Ansible Tower versions prior to 3.3.3 Description: The issue is related to the insecure configuration channel settings for messaging celery workers from RabbitMQ, which could lead to a data leak of sensitive information such as passwords and...