2094 matches found
CVE-2019-10435
CVE-2019-10435 affects the Jenkins SourceGear Vault Plugin. The vulnerability arises because the plugin transmits configured credentials in plain text within job configuration forms, potentially exposing sensitive data. Several connected sources (GHSA, RH, PT-Security, CNVD, CNVD- etc.) confirm t...
undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files
A flaw was found in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user’s credentials from the log files...
CVE-2019-10428
Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...
CVE-2019-10419
Jenkins vFabric Application Director Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
CVE-2019-10422
Jenkins Call Remote Job Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...
CVE-2019-10413
Jenkins Data Theorem: CI/CD Plugin 1.3 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...
CVE-2019-10412
Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...
CVE-2019-10411
Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...
PT-2019-11817 · Jenkins · Jenkins Codescan Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins CodeScan Plugin affected versions not specified Description: The issue concerns the storage of sensitive information in an unencrypted manner. Specifically, the Jenkins CodeScan Plugin stores credentials and an API key unencrypted in...
PT-2019-11821 · Jenkins · Jenkins Aqua Microscanner Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Aqua MicroScanner Plugin version 1.0.7 and earlier Description: The issue involves the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure...
PT-2019-11805 · Jenkins · Jenkins Inedo Buildmaster Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Inedo BuildMaster Plugin versions 2.4.0 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure...
CloudBees Jenkins Beaker Builder Information Disclosure Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Dependency Graph Viewer Plugin is used in...
PT-2019-11104 · Apc · Apc Ups Network Management Card 2
Name of the Vulnerable Software and Affected Versions: APC UPS Network Management Card 2 AOS version 6.5.6 Description: A Credentials Management issue exists, which could cause Remote Monitoring Credentials to be viewed in plaintext when Remote Monitoring is enabled and then disabled...
EulerOS Virtualization for ARM 64 3.0.2.0 : python-requests (EulerOS-SA-2019-1947)
According to the version of the python-requests package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 30...
Atlassian Confluence Server and Confluence Data Center File Disclosure Vulnerability
Atlassian Confluence Server is a suite of professional enterprise knowledge management and collaboration software from Atlassian Australia that can also be used to build enterprise WiKi.Confluence Data Center is the data center version of Confluence Center. A security vulnerability exists in...
CVE-2019-13348
CVE-2019-13348 affects Knowage up to 6.1.1: an authenticated user who visits the datasources page can access data source credentials in cleartext (including database credentials). Multiple connected sources corroborate this vulnerability (NVD entry, Red Hat advisory, CNVD, OSV, CVE listings). Roo...
CloudBees Jenkins JClouds Plugin Authorization Issues Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . An authorization issue vulnerability exists in CloudBees Jenkins JClouds Plugin, which can be exploited by an attacker to gain access to credentials stored in...
PT-2019-11779 · Jenkins · Jenkins Eggplant Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins eggPlant Plugin version 2.2 and earlier Description: The issue allows credentials to be stored unencrypted in job config.xml files on the Jenkins master. These credentials can be viewed by users with Extended Read permission or those...
python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 302 from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker coul...
