CVE-2019-16551

Jenkins Gerrit Trigger Plugin versions 2.30.1 and earlier are affected by a cross-site request forgery vulnerability that allows an attacker to cause the plugin to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials. Root cause: CSRF in the plugin’s handli...

PT-2019-14707 · Jenkins · Jenkins Gerrit Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Gerrit Trigger Plugin versions 2.30.1 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified...

PT-2019-14706 · Jenkins · Jenkins Gerrit Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Gerrit Trigger Plugin versions 2.30.1 and earlier Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials. Recommendations: For...

CSRF vulnerability and missing permission checks in gerrit-trigger

gerrit-trigger 2.30.1 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to perform connection tests, connecting to an HTTP URL or SSH server using attacker-specified credentials, or determine whether files with an...

CVE-2019-16552: Incorrect Default Permissions

A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins maste...

CVE-2019-16551: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials...

Unspecified Vulnerability in CloudBees Jenkins Sonar Gerrit Plugin

CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. company CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed execution of the task . Sonar Gerrit Plugin is used in on...

CVE-2019-10467

Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10467

Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

Design/Logic Flaw

Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10467

Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10467

The CVE-2019-10467 issue affects the Jenkins Sonar Gerrit Plugin, where credentials are stored unencrypted in job config.xml files on the Jenkins master. This exposes sensitive information to users with Extended Read permission or anyone with access to the master filesystem. The publicly document...

CVE-2019-10467

Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10467: Insufficiently Protected Credentials

Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

sonar-gerrit stored credentials in plain text

sonar-gerrit stores a credential unencrypted in job config.xml files on the Jenkins controller if the 'Override Credentials' option is used. This credential can be viewed by users with Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory,...

PT-2019-11861 · Jenkins · Jenkins Sonar Gerrit Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Sonar Gerrit Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner in job config.xml files on the Jenkins master. These credentials can be accessed by users who have...

SUSE-SU-2019:2046-1 Security update for ardana packages

This update for ardana package fixes the following issues: - Update to version 9.0+git.1560211997.7ac9792: Adds repository list parameter bsc1122825 - Update to version 9.0+git.1557219331.457b6e7: Update gerrit location SCRD-9140 - Switch to new Gerrit Server - Update to version...

Jenkins Gerrit Trigger Plugin Design Vulnerability

Jenkins is an open source software project , is based on Java development of a continuous integration tool . A security vulnerability exists in the GerritManagement.java, GerritServer.java, and PluginImpl.java files in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier versions. An attacker can...

CloudBees Jenkins Gerrit Trigger Plugin Information Disclosure Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . Gerrit Trigger Plugin is the use of...

Authorization

An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to retrieve some configuration information about Gerrit in Jenkins...