CVE-2023-25768: Missing Authorization

A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server...

Missing permission checks in azure-credentials allow enumerating credentials IDs

azure-credentials 253.v887e0f9e898b and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using...

CSRF vulnerability and missing permission checks in azure-credentials

azure-credentials 253.v887e0f9e898b and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified web server. Additionally, these form validation methods do not require POST requests,...

org.jenkins-ci.plugins:azure-acs (>=0.1.0, <=0.2.4), org.jenkins-ci.plugins:azure-app-service (>=0.1, <=0.4.2) +8 more potentially affected by CVE-2023-25766 via org.jenkins-ci.plugins:azure-credentials (>=1.0, <=1.6.1)

org.jenkins-ci.plugins:azure-credentials MAVEN version =1.0, =0.1.0, =0.1, =0.3.0, =0.6.0, =3.0.0, =0.1.0, =1.0.0, =0.4.8, =0.1.0, =1.3, =1.5 Source cves: CVE-2023-25766 Source advisory: MEND:CVE-2023-25766...

org.jenkins-ci.plugins:azure-acs (>=0.1.0, <=0.2.4), org.jenkins-ci.plugins:azure-app-service (>=0.1, <=0.4.2) +8 more potentially affected by CVE-2023-25768 via org.jenkins-ci.plugins:azure-credentials (>=1.0, <=1.6.1)

org.jenkins-ci.plugins:azure-credentials MAVEN version =1.0, =0.1.0, =0.1, =0.3.0, =0.6.0, =3.0.0, =0.1.0, =1.0.0, =0.4.8, =0.1.0, =1.3, =1.5 Source cves: CVE-2023-25768 Source advisory: MEND:CVE-2023-25768...

CVE-2023-25766

CVE-2023-25766 concerns the Jenkins Azure Credentials Plugin (253.v887e0f9e898b and earlier). The root cause is a missing permission check that lets an attacker with Overall/Read access enumerate credential IDs stored in Jenkins. The vulnerability primarily enables information disclosure of crede...

PT-2023-20290

Name of the Vulnerable Software and Affected Versions Jenkins Azure Credentials Plugin versions 253.v887e0f9e898b and earlier Description A missing permission check in the Jenkins Azure Credentials Plugin allows attackers with Overall/Read permission to connect to an attacker-specified web server...

PT-2023-20289

Name of the Vulnerable Software and Affected Versions Jenkins Azure Credentials Plugin versions 253.v887e0f9e898b and earlier Description A missing permission check in the Jenkins Azure Credentials Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials...

CVE-2023-25767

A cross-site request forgery CSRF vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-specified web server...

CVE-2023-25767

CVE-2023-25767 is a CSRF vulnerability affecting Jenkins Azure Credentials Plugin in versions up to 253.v887e0f9e898b and earlier. The Red Hat and OSV entries confirm the flaw permits an attacker to trigger actions that cause the Jenkins client to connect to an attacker-controlled web server, due...

Jenkins Enterprise and Operations Center 2.346.x < 2.346.40.0.9 Multiple Vulnerabilities (CloudBees Security Advisory 2023-02-15)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.346.x prior to 2.346.40.0.9. It is, therefore, affected by multiple vulnerabilities including the following: - CSRF vulnerability and missing permission checks in Synopsys Coverity Plugin allow...

IBM Robotic Process Automation 安全漏洞

IBM Robotic Process Automation is a robotic process automation product from IBM USA. It helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. IBM Robotic Process Automation version 21.0.0, version 21.0.1, and version 21.0.2 contains a security...

Elastic Elasticsearch < 6.3.0 Information Exposure Vulnerability (ESA-2018-11)

Elasticsearch is prone to an information exposure vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2020-1978

TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability HA inadvertently collect Azure dashboard service account credentials. These credentials are equivalent to the credentials associated with the Contributor role in...

Elasticsearch repository-azure information disclosure vulnerability

Elasticsearch is the Netherlands Elasticsearch company based on Lucene built a set of open source distributed RESTful search engine , it is mainly used in cloud computing , and supports the use of JSON via HTTP for data indexing . repository-azure is one of the repository plugin . An information...

Information disclosure

A sensitive data disclosure flaw was found in the Elasticsearch repository-azure formerly elasticsearch-cloud-azure plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged...

CVE-2018-3827

A sensitive data disclosure flaw was found in the Elasticsearch repository-azure formerly elasticsearch-cloud-azure plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged...

CVE-2018-3827

A sensitive data disclosure flaw was found in the Elasticsearch repository-azure formerly elasticsearch-cloud-azure plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged...

CVE-2018-3827

A sensitive data disclosure flaw was found in the Elasticsearch repository-azure formerly elasticsearch-cloud-azure plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged...

PT-2018-16221

Name of the Vulnerable Software and Affected Versions Elasticsearch repository-azure plugin affected versions not specified Description A sensitive data disclosure issue was discovered in the Elasticsearch repository-azure plugin. The flaw occurs when the plugin is configured to log at the TRACE...