CVE-2020-2297: Insufficiently Protected Credentials

Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2020-2249

Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system...

PT-2020-6757 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to weak permissions of the /opt/axess/etc/default/axess file in the Zyxel CloudCNM SecuManager software, which is used for centralized device management...

The vulnerability of the Schneider Electric Easergy Builder software in terms of controller configuration lies in the use and storage of the cryptographic key in an unencrypted form. This allows a hacker to decrypt user passwords.

The vulnerability of the Schneider Electric Easergy Builder software for configuring controllers is related to the use and storage of the cryptographic key in an unencrypted form. Exploiting this vulnerability could allow a hacker to decrypt user passwords...

The vulnerability of the org.jfrog.hudson.ArtifactoryBuilder.xml component of the Jenkins Artifactory Plugin allows a hacker to obtain user credentials.

The vulnerability of the org.jfrog.hudson.ArtifactoryBuilder.xml component of the Jenkins Artifactory Plugin is related to the unencrypted storage of confidential information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain user credentials...

The vulnerability of the software for configuring Schneider Electric Easergy Builder lies in the storage of confidential information in an unencrypted form, allowing a perpetrator to gain access to user credentials.

The vulnerability of the Schneider Electric Easergy Builder software for configuring controllers is related to the storage of confidential information in an unencrypted form. Exploiting this vulnerability could allow a perpetrator to gain access to user credentials...

PT-2020-5202

Name of the Vulnerable Software and Affected Versions CmtViewer affected versions not specified Description The issue is related to the storage of protected information in an unencrypted form. This could allow a remote attacker to gain access to the protected information. Recommendations At the...

PT-2020-5193

Name of the Vulnerable Software and Affected Versions EasyBuilder affected versions not specified Description The issue is related to the storage of protected information in an unencrypted form. This could allow a remote attacker to gain access to the device. Recommendations At the moment, there ...

The vulnerability of the Simple Mail Transfer Protocol (SMTP) software of RSLogix 500, as well as the programmable logic controllers MicroLogix 1100 and MicroLogix 1400, allows a intruder to gain unauthorized access to confidential information.

The vulnerability of the Simple Mail Transfer Protocol SMTP software from RSLogix 500, as well as the programmable logic controllers MicroLogix 1100 and MicroLogix 1400, is related to the unencrypted storage of critical information. Exploiting this vulnerability allows an attacker to gain access ...

CVE-2020-2128

CVE-2020-2128 affects the Jenkins ECX Copy Data Management Plugin (versions ≤ 1.9). The root cause is passwords stored unencrypted in job config.xml on the Jenkins master. This allows disclosure to users with Extended Read permissions or to anyone with master filesystem access. The provided docum...

CVE-2020-2125

Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system...

CVE-2020-2107

Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

The vulnerability of the “/api/v2/config” component in the Red Hat Ansible Tower management console allows a malicious individual to gain unauthorized access to application user passwords.

The vulnerability of the “/api/v2/config” component in the Red Hat Ansible Tower management console is related to the unencrypted storage of confidential information. Exploiting this vulnerability could allow an attacker to gain unauthorized access to the application user passwords...

PT-2019-14711 · Jenkins · Jenkins Rundeck Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Rundeck Plugin versions 3.6.5 and earlier Description: The issue allows credentials to be stored unencrypted in the global configuration file and in job config.xml files on the Jenkins master. This can be accessed by users with Extend...

CVE-2019-16543

Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-10443

CVE-2019-10443 affects Jenkins iceScrum Plugin up to version 1.1.4, where credentials are stored unencrypted in job config.xml on the Jenkins master. This enables access by users with Extended Read permission or access to the master filesystem, per multiple advisories (ZDI-19-933, Jenkins securit...

PT-2019-11847 · Jenkins · Jenkins Delphix Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Delphix Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file of the Jenkins master. This allows users with access to the master...

CVE-2019-10419

Jenkins vFabric Application Director Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

PT-2019-11807 · Jenkins · Jenkins Data Theorem: Ci/Cd Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Data Theorem: CI/CD Plugin versions 1.3 and earlier Description: The issue concerns the storage of credentials in an unencrypted manner in job config.xml files on the Jenkins master. This allows users with Extended Read permission or...

PT-2019-11810 · Jenkins · Jenkins Violation Comments To Gitlab Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Violation Comments to GitLab Plugin version 2.28 and earlier Description: The issue concerns the storage of credentials in an unencrypted manner. Specifically, the Violation Comments to GitLab Plugin stored API tokens unencrypted in j...