CVE-2019-16544

Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

PT-2019-14700 · Jenkins · Jenkins Qmetry For Jira - Test Management Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins QMetry for JIRA - Test Management Plugin versions prior to 1.13 Description: The issue concerns the transmission of credentials in plain text as part of job configuration forms, potentially leading to their exposure. Although the...

Code injection

Unprotected Transport of Credentials in ePO extension in McAfee Data Loss Prevention 11.x prior to 11.4.0 allows remote attackers with access to the network to collect login details to the LDAP server via the ePO extension not using a secure connection when testing LDAP connectivity...

Unspecified vulnerability in McAfee Data Loss Prevention Endpoint ePO extension

McAfee Data Loss Prevention Endpoint DLPe is an integrated endpoint data protection solution from McAfee, Inc. that prevents theft and accidental disclosure of confidential data and provides security policies for file processing and transmission, shared data flow control and data encryption. The...

Amazon Linux 2 : python-requests (ALAS-2019-1334)

A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 302 from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker coul...

ansible: secrets disclosed on logs when no_log enabled

Ansible was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process...

GHSA-J52R-XC68-Q8F4 Insufficiently Protected Credentials in Pivotal Reactor Netty

Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to...

python: Information Disclosure due to urlsplit improper NFKC normalization

It was discovered that python's functions urllib.parse.urlsplit and urllib.parse.urlparse do not properly handle URLs encoded with Punycode/Internationalizing Domain Names in Applications IDNA, which may result in a wrong domain name specifically the netloc component of URL - user@domain:port bei...

Unspecified Vulnerability in CloudBees Jenkins Fortify on Demand Plugin

CloudBees Jenkins Hudson Labs is a set of Java-based continuous integration tools from CloudBees. The product is mainly used to monitor the continuous software version of the release/testing project and some timed tasks . Fortify on Demand Plugin is used in one of the support for uploading code...

Low: python-requests

Issue Overview: A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 302 from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-midd...

CVE-2019-10716

CVE-2019-10716 affects Verodin Director 3.5.3.1 and earlier. The vulnerability is an information-disclosure flaw where the REST API endpoint /integrations.json can reveal usernames and passwords of integrated security tools (e.g., Splunk, ArcSight, Palo Alto, AWS Cloud Trail) to authenticated use...

PT-2019-11847 · Jenkins · Jenkins Delphix Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Delphix Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file of the Jenkins master. This allows users with access to the master...

CVE-2019-17398

In the Dark Horse Comics application 1.3.21 for Android, token information equivalent to the username and password is stored in the log during authentication, and may be available to attackers via logcat...

undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files

A flaw was found in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user’s credentials from the log files...

CloudBees Jenkins vFabric Application Director plugin security vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . vFabric Application Director Plugin is used i...

Design/Logic Flaw

Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2019-10435

CVE-2019-10435 affects the Jenkins SourceGear Vault Plugin. The vulnerability arises because the plugin transmits configured credentials in plain text within job configuration forms, potentially exposing sensitive data. Several connected sources (GHSA, RH, PT-Security, CNVD, CNVD- etc.) confirm t...

CVE-2019-10434

Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files

A flaw was found in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user’s credentials from the log files...