CVE-2026-84665

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permissi...

CVE-2026-84665

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permissi...

CVE-2026-84665

The Jenkins SonarQube Scanner Plugin version 2.18.3 and earlier is vulnerable to a stored cross-site scripting (XSS) issue. The root cause is a failure to limit URL schemes for dashboard links created from SonarQube scanner results, which allows the use of the javascript: scheme. Attackers with I...

EUVD-2026-70131

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permissi...

CVE-2026-84665

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permissi...

PT-2026-84788

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permissi...

CVE-2026-84665: Improper Neutralization of Input During Web Page Generation

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permissi...

GHSA-3CCQ-GCCX-PM7J Jenkins SonarQube Scanner Plugin stored server authentication token in plain text

An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube...

CloudBees Jenkins SonarQube Scanner Plugin Authentication Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. It is mainly used to monitor continuous software release/testing projects and some timed tasks.SonarQube Scanner Plugin is a plugin used in the scanning and checking the qualit...

CVE-2018-1000425

An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube...

Design/Logic Flaw

An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube...

CVE-2018-1000425

An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube...

CVE-2018-1000425

The CVE concerns the Jenkins SonarQube Scanner Plugin (up to version 2.8) where credentials used to connect to SonarQube are stored in plaintext in SonarInstallation.java. This insufficient protection allows an attacker with local filesystem access to extract the server authentication credentials...

CVE-2018-1000425: Insufficiently Protected Credentials

An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube...

PT-2019-8736

Name of the Vulnerable Software and Affected Versions Jenkins SonarQube Scanner Plugin versions 2.8 and earlier Description An insufficiently protected credentials issue exists in the SonarInstallation.java file, allowing attackers with local file system access to obtain the credentials used to...

SonarQube Scanner Plugin stored server authentication token in plain text

SonarQube Scanner Plugin stored a server authentication token unencrypted in its global configuration file on the Jenkins controller. This token could be viewed by users with access to the Jenkins controller file system. The plugin now stores the token encrypted in the configuration files on disk...