Secret stored in plain text by github-coverage-reporter

github-coverage-reporter 1.8 and earlier stores a GitHub access token in plain text in its global configuration file io.jenkins.plugins.gcr.PluginConfiguration.xml. This token can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no...

delphix stores credentials in plain text

delphix stores credentials unencrypted in its global configuration file io.jenkins.plugins.delphix.GlobalConfiguration.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. As of publication of this advisory there is no fix...

CVE-2018-11126: Cross-Site Request Forgery (CSRF)

dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account...

PT-2018-10320

Name of the Vulnerable Software and Affected Versions doorGets version 7.0 Description The issue concerns a CSRF problem in the dg-user/?controller=users&action=add API endpoint, which can lead to the addition of an administrator account. Recommendations For doorGets version 7.0, consider...