CVE-2025-53655

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it...

CVE-2025-53654

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

CVE-2025-53655

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it...

CVE-2025-53655: Plaintext Storage of a Password

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it...

PT-2025-28906 · Jenkins · Jenkins Statistics Gatherer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Statistics Gatherer Plugin versions 2.0.3 and earlier Description: The Jenkins Statistics Gatherer Plugin stores the AWS Secret Key unencrypted in its global configuration file...

PT-2025-28907 · Jenkins · Jenkins Statistics Gatherer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Statistics Gatherer Plugin versions 2.0.3 and earlier Description: The Jenkins Statistics Gatherer Plugin does not mask the AWS Secret Key on the global configuration form and stores it unencrypted in the...

CVE-2025-53654: Insufficiently Protected Credentials

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

Malware in aws-sdk-react-native-core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-49618

In Plesk Obsidian 18.0.69, unauthenticated requests to /loginup.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint...

CVE-2025-49618

In Plesk Obsidian 18.0.69, unauthenticated requests to /loginup.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint...

CVE-2025-49618: Transmission of Private Resources into a New Sphere

In Plesk Obsidian 18.0.69, unauthenticated requests to /loginup.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint...

CVE-2025-49618

In Plesk Obsidian 18.0.69, unauthenticated requests to /loginup.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint...

PT-2025-27799 · Plesk · Plesk Obsidian

Name of the Vulnerable Software and Affected Versions: Plesk Obsidian version 18.0.69 Description: The issue allows unauthenticated requests to the "/login up.php" API endpoint to reveal sensitive AWS credentials, including accessKeyId, secretAccessKey, region, and endpoint. Recommendations: For...

SUSE SLES15: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (SUSE-SU-SUSE-RU-2025:02204-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2025:02204-1 advisory. - Fix idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243859 - Update to version 1.4....

SUSE SLES15: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (SUSE-SU-SUSE-RU-2025:02203-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2025:02203-1 advisory. - Fix idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243859 - Update to version 1.4.2 - Update...

CVE-2025-49618

CVE-2025-49618 affects Plesk Obsidian 18.0.69. Unauthenticated requests to /login_up.php can disclose AWS credentials (accessKeyId, secretAccessKey, region, endpoint). Documented CVSSv3.1 base score 5.8 (Medium) with network attack vector, low attack complexity, no privileges required, and scope ...

CVE-2025-49618

In Plesk Obsidian 18.0.69, unauthenticated requests to /loginup.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint...

org.lucee:aws-sm (>=1.0.0.5-rc, <=1.1.0.4-rc), org.lucee:chart (>=3.0.0.0-beta, <=3.0.0.1-beta) +13 more potentially affected by CVE-2025-34074 via org.lucee:lucee (>=6.1.1.118, <=7.1.0.2-alpha)

org.lucee:lucee MAVEN version =6.1.1.118, =1.0.0.5-rc, =3.0.0.0-beta, =1.0.0.0-alpha, =1.0.0.0-alpha, =3.0.0.0-alpha, =1.0.0.17-beta, =1.0.0.0-rc, =3.0.0.0-beta, =2.1.0.0-beta, =1.0.0.2-rc, =1.0.0.3 Source cves: CVE-2025-34074 Source advisory: SNYK:JAVA-ORGLUCEE-10587798...

SUSE-RU-2025:02204-1 Recommended update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues: - Fix idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243859 - Update to version 1.4.2 - Update aws-nitro-enclaves-sdk-bootstrap to version f718dea6 - Update to version 1.3.3git0.afb7264 - Update...

SUSE-RU-2025:02203-1 Recommended update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues: - Fix idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243859 - Update to version 1.4.2 - Update aws-nitro-enclaves-sdk-bootstrap to version f718dea6 - Update to version 1.3.3git0.afb7264 - Update...