CVE-2023-30530

Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2023-30528

CVE-2023-30528 affects Jenkins WSO2 Oauth Plugin 1.0 and earlier. Root cause: the WSO2 Oauth client secret is stored unencrypted in the global config.xml and the global configuration form does not mask the secret, enabling observers with Jenkins controller file-system access to view the secret. I...

CVE-2023-30528

Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers to observe and capture it...

CVE-2023-30527

Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2023-30527

Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

PT-2023-22759 · Hashicorp +1 · Hashicorp Consul +2

Name of the Vulnerable Software and Affected Versions: Jenkins Consul KV Builder Plugin versions 2.0.13 and earlier Description: The issue concerns the storage of the HashiCorp Consul ACL Token in the global configuration file on the Jenkins controller. This token is stored unencrypted and can be...

Jenkins Plugin WSO2 Oauth Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Jenkins Plugin Consul KV Builder security vulnerabilities

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2023-29543

An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android 112, Firefox 112, and Focus for Android 112...

PT-2023-22756 · Jenkins · Jenkins Wso2 Oauth Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins WSO2 Oauth Plugin versions 1.0 and earlier Description: The issue concerns the storage and display of the WSO2 Oauth client secret in the Jenkins WSO2 Oauth Plugin. Specifically, the client secret is stored unencrypted in the global...

PT-2023-22760 · Hashicorp +1 · Hashicorp Consul +2

Name of the Vulnerable Software and Affected Versions: Jenkins Consul KV Builder Plugin versions 2.0.13 and earlier Description: The issue concerns the storage and display of the HashiCorp Consul ACL Token in the Jenkins Consul KV Builder Plugin. Specifically, the token is stored unencrypted in t...

Token stored and displayed in plain text by consul-kv-builder

consul-kv-builder 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file org.jenkinsci.plugins.consulkv.GlobalConsulConfig.xml on the Jenkins controller as part of its configuration. This token can be viewed by users with access to the Jenkins...

PT-2023-22755 · Jenkins · Jenkins Wso2 Oauth Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins WSO2 Oauth Plugin versions 1.0 and earlier Description: The issue concerns the storage of the WSO2 Oauth client secret in an unencrypted form within the global config.xml file on the Jenkins controller. This file can be accessed by...

UBUNTU-CVE-2023-29543

An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android 112, Firefox 112, and Focus for Android 112...

CVE-2023-30527: Cleartext Storage of Sensitive Information

Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

HPESBGN04468 rev.1 - HPE OneView Global Dashboard (OVGD), Disclosure of Privileged Information

Potential Security Impact: Local: Disclosure of Privileged Information, Disclosure of Sensitive Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE OneView Global Dashboard prior to 2.72 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2023-280...

Researcher Spotlight: Giannis Tziakouris first learned how to fix his family’s PC, and now he’s fixing networks all over the globe

Giannis Tziakouris had a problem growing up: He kept breaking his PC. He loved experimenting on his familys home computer, but things didnt always go as planned. Thats when his dad told him he had to learn how to fix the PC and get it back up and running, or hed revoke Giannis computer access...

PT-2023-20847 · Unknown · Delight Nashorn Sandbox

Name of the Vulnerable Software and Affected Versions: delight-nashorn-sandbox versions 0.2.4 through 0.2.5 Description: The issue allows for sandbox escape when allowExitFunctions is set to false. The loadWithNewGlobal function can be used to invoke the exit and quit methods, leading to the exit...

OSV-2023-284 Global-buffer-overflow in dwg_codepage_dxfstr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57723 Crash type: Global-buffer-overflow READ 8 Crash state: dwgcodepagedxfstr dxfheaderwrite dwgwritedxf...

PT-2023-35758 · Git +1 · Libredwg

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as Global-buffer-overflow READ 8. The crash state involves several functions: dwg codepage dxfstr, dxf...