85 matches found
CVE-2022-25197
Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system...
CVE-2022-25186
Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key...
CVE-2022-25186
Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key...
CVE-2022-25197
CVE-2022-25197 affects Jenkins HashiCorp Vault Plugin, specifically 336.v182c0fbaaeb7 and earlier. The vulnerability allows an attacker who can control agent processes to read arbitrary files on the Jenkins controller file system. The advisory notes exploitation is possible on affected Jenkins ve...
CVE-2022-25186
Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key...
Hashicorp HashiCorp Vault 安全漏洞
Jenkins is a Jenkins open source application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier versions contain an arbitrary file read vulnerability that...
Jenkins 插件 信息泄露漏洞
Jenkins is a Jenkins open source application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins HashiCorp Vault Plugin 3.8.0 and earlier versions are vulnerable to an information disclosure vulnerability that...
PT-2022-1879 · Hashicorp +1 · Jenkins Hashicorp Vault Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins HashiCorp Vault Plugin versions 336.v182c0fbaaeb7 and earlier Description: The issue allows agent processes to read arbitrary files on the Jenkins controller file system. This can be exploited by attackers who can control agent...
CVE-2022-23109
Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed...
CVE-2022-23109
CVE-2022-23109 affects Jenkins HashiCorp Vault Plugin (3.7.0 and earlier). When Pipeline: Groovy Plugin 2.85 or later is installed, Vault credentials are not masked in Pipeline build logs or in Pipeline step descriptions. Root cause: the plugin fails to mask sensitive Vault credentials. Documente...
Jenkins 安全漏洞
Jenkins Plugin is an open source application for Jenkins. A security vulnerability exists in Jenkins Plugin HashiCorp Vault Plugin 3.7.0 that stems from the fact that Jenkins HashiCorp Vault Plugin 3.7.0 or earlier does not block the pipeline when Pipeline: Groovy Plugin 2.85 or later is installe...
PT-2022-15851 · Hashicorp +1 · Jenkins Hashicorp Vault Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins HashiCorp Vault Plugin versions 3.7.0 and earlier Description: The issue concerns the Jenkins HashiCorp Vault Plugin, where Vault credentials are not masked in Pipeline build logs or in Pipeline step descriptions when the Pipeline:...
CVE-2020-8567
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods...
Code injection
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods...
CVE-2020-8567
The CVE concerns Kubernetes Secrets Store CSI Driver plugins (Vault: pre-v0.0.6, Azure: pre-v0.0.10, GCP: pre-v0.2.0) that allow an attacker who can create SecretProviderClass objects to write to arbitrary file paths on the host filesystem (including /var/lib/kubelet/pods). Root cause: insecure h...
CVE-2020-8567 Kubernetes Secrets Store CSI Driver plugin directory traversals
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods...
Kubernetes SIGs Secrets-store-csi-driver path traversal vulnerability
Kubernetes SIGs Secrets-store-csi-driver is a K8s component for storing confidential files based on CSI volumes from the Kubernetes SIGs organization. A security vulnerability in the Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6 can be exploited by an attacker to create special...
CVE-2020-2313
A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2020-2313
Summary: CVE-2020-2313 affects the Jenkins Azure Key Vault Plugin (versions 2.0 and earlier). The issue is a missing permission check on multiple HTTP endpoints, allowing attackers who have Overall/Read permission to enumerate credentials IDs stored in Jenkins. Impact (as stated): Credentials IDs...