GitHub Authentication Plugin showed plain text client secret in configuration form

GitHub Authentication Plugin stores the client secret in the global Jenkins configuration. While the client secret is stored encrypted on disk, it was transmitted in plain text as part of the configuration form and displayed without masking. This could result in exposure of the client secret...

Cross-Site Request Forgery(CSRF)

favorite plugin is vulnerable to cross-site request forgery CSRF. The attacks are possible because it does not send the requests via POST to prevent CSRF according to the Jenkins global security configuration, allowing to modify other user's favorite status...