CVE-2022-36901

Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

The vulnerability of the “Restore Session” function in Web3 wallets for cryptocurrency MetaMask allows a hacker to gain access to the session restoration password.

The vulnerability of the “Restore Session” function in Web3 wallets for cryptocurrency MetaMask relates to the storage of confidential information in an unencrypted form. Exploiting this vulnerability could allow a attacker to gain access to the session restoration function...

Design/Logic Flaw

Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2022-34808

CVE-2022-34808 : Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller, allowing users with file-system access to view sensitive credentials. Root cause is unencrypted storage of tokens in the SparkNotifier.xml/fil...

PT-2022-6642 · Cisco +1 · Jenkins Cisco Spark Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Cisco Spark Plugin versions 1.1.1 and earlier Description: The issue is related to the storage of bearer tokens in an unencrypted form in the global configuration file org.jenkinsci.plugins.spark.SparkNotifier.xml on the Jenkins...

PT-2022-22356 · Jenkins · Jenkins Opsgenie Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OpsGenie Plugin versions 1.9 and earlier Description: The issue concerns the transmission and storage of API keys in plain text. Specifically, API keys are transmitted in plain text as part of the global Jenkins configuration form and...

CVE-2022-34213

CVE-2022-34213 affects the Jenkins Squash TM Publisher (Squash4Jenkins) Plugin (versions 1.0.0 and earlier). The vulnerability arises from storing passwords unencrypted in the plugin’s global configuration on the Jenkins controller (org.jenkinsci.squashtm.core.SquashTMPublisher.xml). As a result,...

The vulnerability of the FortiOS operating system, related to the unencrypted storage of confidential information, allows attackers to obtain user credentials when a user logs into the system.

The vulnerability of the FortiOS operating system is related to the unencrypted storage of confidential information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain the login credentials of users who access the system...

Passwords stored in plain text by Mail Commander Plugin for Jenkins-ci Plugin

Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

Password stored in plain text by Applatix Plugin

Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system...

Password stored in plain text by ECX Copy Data Management Plugin

Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system...

GHSA-XCJ6-4355-2823 Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token

Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

Private key stored in plain text by Jenkins Google Compute Engine Plugin

Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Agent/Extended Read permission, or access to the Jenkins controller file system...

PT-2022-18840 · Jenkins · Jenkins Proxmox Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Proxmox Plugin versions 0.5.0 and earlier Description: The issue concerns the storage of the Proxmox Datacenter password in an unencrypted manner within the global config.xml file on the Jenkins controller. This allows users with acce...

CVE-2022-27206

Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2022-27195

Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their build.xml files. These values are stored unencrypted and can be viewed by users with access to...

PT-2022-18293 · Jenkins · Jenkins Gitlab Authentication Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins GitLab Authentication Plugin versions 1.13 and earlier Description: The issue concerns the storage of the GitLab client secret in an unencrypted form within the global config.xml file on the Jenkins controller. This allows users with...

The vulnerability of IP-Cisco IP Phone microprogramming software, related to the unencrypted storage of confidential information, allows attackers to gain unauthorized access to protected information.

The vulnerability of IP-Cisco IP phones related to microprogramming software involves the unencrypted storage of confidential information. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

CVE-2022-20660

A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. This vulnerability is due to unencrypted storage of confidential information on an affected device...

Design/Logic Flaw

A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. This vulnerability is due to unencrypted storage of confidential information on an affected device...