CVE-2020-2314

Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

Design/Logic Flaw

Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2020-2314

Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2020-2314

The CVE-2020-2314 issue affects Jenkins AppSpider Plugin 1.0.12 and earlier, where the plugin stores a password unencrypted in the global configuration file on the Jenkins controller. The password is stored in com.rapid7.jenkinspider.PostBuildScan.xml and can be viewed by users with filesystem ac...

PT-2020-15547 · Jenkins · Jenkins Appspider Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins AppSpider Plugin versions 1.0.12 and earlier Description: The issue concerns the storage of a password in an unencrypted form in the global configuration file on the Jenkins controller. This password can be viewed by users with access...

CVE-2020-7358

In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an...

CVE-2020-7358

In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an...

CVE-2020-7358 Code Injection in Rapid7 AppSpider Pro Installer

In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an...

CVE-2020-7358

The CVE-2020-7358 entry relates to the AppSpider Installer. Affected software: AppSpider installer versions prior to 7.2.126. Vulnerable component: the installer launches an executable, which can be placed in the installation directory by a user with local access. Root cause: the installer cannot...

CVE-2019-5647

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue...

CVE-2019-5647

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue...

Session fixation

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue...

CVE-2019-5647 Rapid7 AppSpider Chrome Plugin Insufficient Session Expiration

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue...

CVE-2019-5647

The CVE-2019-5647 issue affects the Chrome Plugin for Rapid7 AppSpider, where browser sessions can remain active after recording a macro and even after Chrome restarts. Affected product: Rapid7 AppSpider Chrome Plugin (versions up to 3.8.213). Root cause: sessions not expired as expected, enablin...

A few words about Gartner’s “Magic Quadrant for Application Security Testing” 2018

February and March are the hot months for marketing reports. I already wrote about IDC and Forrester reports about Vulnerability Management-related markets. And this Monday, March 19, Gartner released new "Magic Quadrant for Application Security Testing". You can buy it on the official website fo...

Rapid7 AppSpider Pro 'FLAnalyzer.exe' Buffer Overflow Vulnerability

AppSpider is a DAST solution designed to help application security personnel test applications as part of DevOps and as part of a scheduled scanning program. A buffer overflow vulnerability in the FLAnalyzer.exe component of Rapid7 AppSpider Pro can be exploited by an attacker to cause a denial o...

Rapid7 AppSpider Pro DLL Preloading Vulnerability (CNVD-2017-10390)

AppSpider is a DAST solution designed to help application security personnel test applications as part of DevOps and as part of a scheduled scanning program. A DLL preloading vulnerability exists in the Rapid7 AppSpider Pro installer, which can be exploited by an attacker to load a malicious DLL...

CVE-2017-5236

Editions of Rapid7 AppSpider Pro installers prior to version 6.14.060 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer...

Design/Logic Flaw

Editions of Rapid7 AppSpider Pro installers prior to version 6.14.060 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer...

CVE-2017-5236

Editions of Rapid7 AppSpider Pro installers prior to version 6.14.060 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer...