CVE-2019-10350

Summary: CVE-2019-10350 affects the CloudBees/Jenkins Port Allocator Plugin. The vulnerability stems from credentials being stored in plaintext in job config.xml files on the Jenkins master, enabling disclosure to users with Extended Read permission or with access to the master filesystem. The CV...

CVE-2019-10348

Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10351

CVE-2019-10351 affects Jenkins Caliper CI Plugin, where credentials are stored unencrypted in job config.xml on the Jenkins master. This allows exposure to users with Extended Read permission or access to the master filesystem, with high-severity impact per CVSS 3.1 (C:H, I:H, A:H). The connected...

CVE-2019-10348

CVE-2019-10348 - Jenkins Gogs Plugin: The vulnerability arises from storing credentials in plaintext in job config.xml on the Jenkins master, enabling disclosure to users with Extended Read or anyone with master filesystem access. The NVD entry notes a CVSS v3.1 base score of 8.8 (HIGH). Public a...

CVE-2019-10350

Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10347

Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-10347

The CVE-2019-10347 issue affects the Jenkins Mashup Portlets Plugin (e.g., CloudBees Jenkins Mashup Portlets) where credentials are stored in plaintext on the Jenkins master filesystem. Root cause per sources is unencrypted credential storage that allows users with master-file-system access to vi...

PT-2019-11750 · Jenkins · Jenkins Caliper Ci Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Caliper CI Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within job config.xml files on the Jenkins master or controller. These credentials can be accessed b...

PT-2019-11747 · Jenkins · Jenkins Gogs Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Gogs Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted form in job config.xml files on the Jenkins master or controller. These credentials can be accessed by users with...

PT-2019-11749 · Jenkins · Jenkins Port Allocator Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Port Allocator Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted form within job config.xml files on the Jenkins master or controller. These credentials can be accessed...

PT-2019-11746 · Jenkins · Jenkins Mashup Portlets Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Mashup Portlets Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner on the Jenkins master, making them accessible to users with file system access. Recommendations...

JetBrains TeamCity Encryption Security Vulnerability

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. An encryption issue vulnerability exists in...

CVE-2019-12845

The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3...

CVE-2019-12845

The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3...

Code injection

The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3...

CVE-2019-12845

CVE-2019-12845 affects JetBrains TeamCity. The generated Kotlin DSL settings allowed artifacts to be resolved over an unencrypted connection, exposing potential MITM risks. Root cause: unencrypted artifact resolution in Kotlin DSL settings. Impact: exposure of artifact resolution traffic (no deta...

CVE-2019-12845

The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3...

CVE-2019-9872

In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. If the Settings Repository plugin was then used and configured to synchronize...

Design/Logic Flaw

In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8...

UBUNTU-CVE-2019-9873

In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8...