inflectra-spira-integration stored credentials in plain text

inflectra-spira-integration stored a credential unencrypted in its global configuration file com.inflectra.spiratest.plugins.SpiraBuilder.xml on the Jenkins controller. This credential could be viewed by users with access to the Jenkins controller file system. inflectra-spira-integration now stor...

elOyente stores credentials in plain text

elOyente stores a password unencrypted in its global configuration file com.technicolor.eloyente.ElOyente.xml on the Jenkins controller. This password can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no fix...

Authentication Bypass Vulnerability in Triconex SIS System

The Triconex SIS system is a modern programmable logic and process controller. An authentication bypass vulnerability exists in the Triconex SIS system, which could be exploited by an unauthorized attacker to gain access to the controller...

UBUNTU-CVE-2019-3887

A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister MSR access with nested=1 virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash t...

PT-2019-11361 · Jenkins · Jenkins Octopusdeploy Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins OctopusDeploy Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins master or controller. Specifically, the...

PT-2019-11364 · Jenkins · Jenkins Hyper.Sh Commons Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Hyper.sh Commons Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins master or controller. Specifically,...

crittercism-dsym stores API key in plain text

crittercism-dsym stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

ftppublisher stores credentials in plain text

ftppublisher stores credentials unencrypted in its global configuration file com.zanox.hudson.plugins.FTPPublisher.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

Ansible: path traversal in the fetch module

A path traversal flaw was found in ansible. The fetch module allows copying and overwriting files outside of the specified destination in the local ansible controller host by not restricting an absolute path. The main threat from this vulnerability is to data confidentiality and integrity...

CMS ISWEB Path Traversal Vulnerability

CMS ISWEB is a content management system CMS. A directory traversal vulnerability exists in CMS ISWEB version 3.5.3. An attacker can exploit this vulnerability to download the config.php file and take control of the application...

The vulnerability of the CX-Programmer development environment, related to the reversibility of the password encoding method, allows attackers to obtain the password necessary to access the controller.

The vulnerability of the development environment CX-Programmer, which is part of the CX-One software suite designed for programming and configuring Omron PLCs, relates to the reversibility of the password encoding method. Exploiting this vulnerability allows a malicious actor to obtain the passwo...

UCOPIA Wireless Appliance 5.1 (Captive Portal) - Root Remote Code Execution Vulnerability

Exploit for linux platform in category remote exploits Exploit Title: Unauthenticated remote root code execution on captive portal Ucopia '/var/www/html/upload/bd.php;echo%20t As php is in sudoers without password...