Design/Logic Flaw

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords...

Design/Logic Flaw

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration...

CVE-2018-1000609

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration...

CVE-2018-1000610

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords...

CVE-2018-1000609

The CVE-2018-1000609 issue affects Jenkins Configuration as Code Plugin (0.7-alpha and earlier). The vulnerability arises from ConfigurationAsCode.java, allowing users with Overall/Read access to export the Jenkins YAML configuration, exposing sensitive information. Impact is exposure of configur...

CVE-2018-1000610

The CVE-2018-1000610 entry concerns the Jenkins Configuration as Code Plugin (0.7-alpha and earlier). The vulnerability arises from insecure handling of passwords configured via the plugin, specifically in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, and ExtensionConfigurato...

CVE-2018-1000609

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration...

CVE-2018-1000610

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords...

CVE-2018-1000609: Exposure of Sensitive Information to an Unauthorized Actor

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration...

CVE-2018-1000610: Insufficiently Protected Credentials

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords...

PT-2018-9464

Name of the Vulnerable Software and Affected Versions Jenkins Configuration as Code Plugin versions 0.7-alpha and earlier Description A sensitive information exposure issue exists in the Jenkins Configuration as Code Plugin, specifically in ConfigurationAsCode.java, allowing attackers with...

PT-2018-9465

Name of the Vulnerable Software and Affected Versions Jenkins Configuration as Code Plugin versions 0.7-alpha and earlier Description A sensitive information exposure issue exists that allows attackers with access to Jenkins log files to obtain passwords configured using the plugin. This is due t...

Configuration as Code Plugin logged passwords in clear text

Configuration as Code Plugin logged secrets set via its configuration to the Jenkins controller system log in plain text. This allowed users with access to the Jenkins log files to obtain these passwords and similar secrets. Secrets are now masked when logging configuration...

Configuration as Code Plugin allowed anyone with Overall/Read access to export Jenkins configuration

Configuration as Code Plugin lacked a permission check in the method handling the URL exporting the system configuration. This allowed users with Overall/Read access to Jenkins to obtain this YAML export. This permission check has been added in Configuration as Code Plugin 0.8-alpha...

Coremail邮件系统存储型XSS之二

简要描述： 设计错误导致可执行恶意JavaScript代码并窃取用户cookies 详细说明： 将特制的swf文件作为附件发送给受害者（这里可以选择在过节的时候下手，比如将文件名改称新年贺卡.swf）： swf文件的AS代码如下（将就着看吧，东拼西凑整出来的）： package import flash.external.ExternalInterface; import flash.display.Sprite; import flash.display.Sprite; import flash.events.Event; import flash.net.URLLoader;...