CVE-2019-16576: Missing Authorization

A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or...

CVE-2019-16574: Missing Authorization

A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2019-16575: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials...

CVE-2019-16573: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

PT-2019-14728 · Jenkins · Jenkins Alauda Devops Pipeline Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Alauda DevOps Pipeline Plugin versions 2.3.2 and earlier Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing...

PT-2019-14730 · Jenkins · Jenkins Alauda Kubernetes Support Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Alauda Kubernetes Support Plugin versions 2.3.0 and earlier Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing the...

Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CSRF vulnerability and missing permission checks in alauda-devops-pipeline allows capturing credentials

alauda-devops-pipeline 2.3.2 and earlier does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to Kubernetes-related paths on an attacker-specified web server using attacker-specified credentials IDs obtained...

alauda (0.2.2) potentially affected by CVE-2018-1000807 via pyopenssl (0.13.1)

pyopenssl PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyopenssl and may be impacted: - alauda 0.2.2 Source cves: CVE-2018-1000807 Source advisory: OSV:GHSA-P28M-34F6-967Q...

alauda (0.2.2) potentially affected by CVE-2018-1000808 via pyopenssl (0.13.1)

pyopenssl PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyopenssl and may be impacted: - alauda 0.2.2 Source cves: CVE-2018-1000808 Source advisory: OSV:GHSA-2RCM-PHC9-3945...

alauda (0.2.2) potentially affected by CVE-2018-1000807 via pyopenssl (0.13.1)

pyopenssl PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyopenssl and may be impacted: - alauda 0.2.2 Source cves: CVE-2018-1000807 Source advisory: OSV:PYSEC-2018-23...

alauda (0.2.2) potentially affected by CVE-2018-1000808 via pyopenssl (0.13.1)

pyopenssl PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyopenssl and may be impacted: - alauda 0.2.2 Source cves: CVE-2018-1000808 Source advisory: OSV:PYSEC-2018-24...

alauda (0.2.2), burp-ui (>=0.4.1, <=0.5.1) +88 more potentially affected by CVE-2018-1000808 via pyopenssl (>=0.13.0, <=17.4.0)

pyopenssl PYPI version =0.13.0, =0.4.1, =1.2.1.20160901, =0.9.5, =0.2.10.3, =2.2.0, =0.5.0, =0.3.0, =0.2.4, =0.9.2, =0.9.7, =1.9.5, =1.9.65 and more Source cves: CVE-2018-1000808 Source advisory: MEND:CVE-2018-1000808...

alauda (>=0.2.1, <=0.2.2), catsup (>=0.3.8, <=0.3.11) +5 more potentially affected by CVE-2017-18342 via pyyaml (3.10.0)

pyyaml PYPI version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyyaml and may be impacted: - alauda =0.2.1, =0.3.8, =0.0.6, =1.0.0, =1.0.0a1, =1.0.2.0.3, =1.0.3.0.3.post1 - thumpy 0.3.2 Source cves: CVE-2017-18342 Source advisory:...