CVE-2021-21648

Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting XSS vulnerability...

Cross site scripting

Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2021-21648

Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2021-21648

CVE-2021-21648 affects Jenkins Credentials Plugin; versions 2.3.18 and earlier do not escape user-controlled information on a view, causing a reflected XSS. Impact and exact exploitation details are not expanded in the provided documents beyond this description. Remediation known from related adv...

Jenkins Credentials Plugin 跨站脚本漏洞

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

PT-2021-14691 · Jenkins · Jenkins Credentials Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Credentials Plugin versions prior to 2.3.19 Description: The issue results in a reflected cross-site scripting XSS vulnerability due to the plugin not escaping user-controlled information on a view it provides. Recommendations: For...

CVE-2021-21648: Improper Neutralization of Input During Web Page Generation

Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2021-21625

Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circumstances...

CVE-2021-21625

Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circumstances...

CVE-2021-21625

CVE-2021-21625 affects Jenkins CloudBees AWS Credentials Plugin, version 1.28 and earlier. The underlying issue is a missing permission check in a helper method for HTTP endpoints, enabling attackers with Overall/Read permission to enumerate AWS credentials IDs stored in Jenkins under certain con...

PT-2021-14668 · Amazon +2 · Aws Parameter Store Build Wrapper +4

Name of the Vulnerable Software and Affected Versions: Jenkins CloudBees AWS Credentials Plugin versions 1.28 and earlier Description: The issue allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins under certain circumstances. This can...

CVE-2021-21625: Missing Authorization

Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circumstances...

PT-2020-15356 · Jenkins · Credentials Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins Zephyr Enterprise Test Management Plugin versions 1.9.1 and earlier Description: The issue concerns the storage of the Zephyr password in plain text on the Jenkins master file system, specifically in the global configuration file...

Credentials stored in plain text by zephyr-enterprise-test-management

zephyr-enterprise-test-management 1.9.1 and earlier stores its Zephyr password in plain text in the global configuration file com.thed.zephyr.jenkins.reporter.ZeeReporter.xml. This password can be viewed by users with access to the Jenkins controller file system. zephyr-enterprise-test-management...

CloudBees Jenkins Google OAuth Credentials Plugin Arbitrary File Read Vulnerability

CloudBees Jenkins is a set of Java-based development of continuous integration tools . A security vulnerability in CloudBees Jenkins Google OAuth Credentials Plugin allows remote attackers to exploit the vulnerability to submit a special request that can read the contents of system files on the...

CVE-2019-10436

An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master...

CVE-2019-10436

An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master...

CVE-2019-10436

The CVE-2019-10436 issue affects Jenkins Google OAuth Credentials Plugin up to version 0.9. The vulnerability allows attackers who can configure jobs and credentials in Jenkins to read arbitrary files on the Jenkins master, due to an improper access control path. Public details consistently descr...

CVE-2019-10436: Undefined Security Weakness

An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master...

PT-2019-11830 · Jenkins · Jenkins Google Oauth Credentials Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Google OAuth Credentials Plugin version 0.9 and earlier Description: The issue allows attackers who can configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master due to an arbitrary file read...