Jenkins Statistics Gatherer Plugin vulnerability exposes AWS Secret Key

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file org.jenkins.plugins.statistics.gatherer.StatisticsConfiguration.xml on the Jenkins controller as part of its configuration. This key can be viewed by users with access to th...

Credential Exposure

Overview Affected versions of this package are vulnerable to Credential Exposure in the storage of the AWS Secret Key in the global configuration file on the controller. An attacker can obtain sensitive credentials by accessing the file system where the configuration file is stored. Remediation...

CVE-2025-53654

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

CVE-2025-53655

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it...

CVE-2025-53654

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

CVE-2025-53654

The Jenkins Statistics Gatherer Plugin (version 2.0.3 and earlier) is vulnerable to Sensitive Information Disclosure because it stores the AWS Secret Key unencrypted in its global configuration file, specifically org.jenkins.plugins.statistics.gatherer.StatisticsConfiguration.xml. Attackers with ...

CVE-2025-53655

The Jenkins Statistics Gatherer Plugin (version 2.0.3 and earlier) is vulnerable to Sensitive Information Disclosure . The plugin fails to mask the AWS Secret Key on the global configuration form, allowing attackers with configuration access to observe and capture the secret value. Additionally, ...

CVE-2025-53654

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

CVE-2025-53655

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it...

CVE-2025-53654

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

CVE-2025-53655

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it...

CVE-2025-53654

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

CVE-2025-53655

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it...

PT-2025-28907 · Jenkins · Jenkins Statistics Gatherer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Statistics Gatherer Plugin versions 2.0.3 and earlier Description: The Jenkins Statistics Gatherer Plugin does not mask the AWS Secret Key on the global configuration form and stores it unencrypted in the...

PT-2025-28906 · Jenkins · Jenkins Statistics Gatherer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Statistics Gatherer Plugin versions 2.0.3 and earlier Description: The Jenkins Statistics Gatherer Plugin stores the AWS Secret Key unencrypted in its global configuration file...

CVE-2025-53655: Plaintext Storage of a Password

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it...

CVE-2025-53654: Insufficiently Protected Credentials

Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

Malware in aws-sdk-react-native-core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

dagit (0.13.17), dagster-airbyte (0.13.17) +31 more potentially affected by CVE-2023-51232 via dagster (0.13.17)

dagster PYPI version 0.13.17 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.13.17 - dagster-airbyte 0.13.17 - dagster-airflow 0.13.17 - dagster-aws 0.13.17 - dagster-azure 0.13.17 - dagster-celery 0.13.17 -...

dagit (0.14.18rc6), dagster-airbyte (0.14.18rc6) +35 more potentially affected by CVE-2023-51232 via dagster (0.14.18rc6)

dagster PYPI version 0.14.18rc6 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.14.18rc6 - dagster-airbyte 0.14.18rc6 - dagster-airflow 0.14.18rc6 - dagster-aws 0.14.18rc6 - dagster-azure 0.14.18rc6 - dagster-cele...