CVE-2019-10443

Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10442

A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...

CVE-2019-10443

Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10441

A cross-site request forgery vulnerability in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials...

CVE-2019-10441

A cross-site request forgery vulnerability in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials...

CVE-2019-10442

A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...

Cross site request forgery (csrf)

A cross-site request forgery vulnerability in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials...

Design/Logic Flaw

A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...

Design/Logic Flaw

Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10442

A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...

CVE-2019-10443

Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10443

CVE-2019-10443 affects Jenkins iceScrum Plugin up to version 1.1.4, where credentials are stored unencrypted in job config.xml on the Jenkins master. This enables access by users with Extended Read permission or access to the master filesystem, per multiple advisories (ZDI-19-933, Jenkins securit...

CVE-2019-10442

Vulnerability (CVE-2019-10442): Jenkins iceScrum Plugin versions 1.1.5 and earlier suffer from a missing permission check that allows attackers with Overall/Read permissions to connect to an attacker-specified URL using attacker-specified credentials. The issue is mitigated by upgrading to versio...

CVE-2019-10441

A cross-site request forgery vulnerability in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials...

CVE-2019-10441

CVE-2019-10441 describes a CSRF in the Jenkins iceScrum Plugin (versions up to 1.1.5) that allowed an attacker to connect to an attacker‑specified URL using attacker‑specified credentials. The issue affects Jenkins iceScrum Plugin ≤ 1.1.5 and is mitigated by upgrading to version 1.1.6, per multip...

PT-2019-11836 · Jenkins · Jenkins Icescrum Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins iceScrum Plugin versions 1.1.5 and earlier Description: A missing permission check in the Jenkins iceScrum Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified...

PT-2019-11835 · Jenkins · Jenkins Icescrum Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins iceScrum Plugin versions 1.1.5 and earlier Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials. Recommendations: For Jenkins iceScrum Plugin...

PT-2019-11837 · Jenkins · Jenkins Icescrum Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins iceScrum Plugin version 1.1.4 and earlier Description: The issue allows stored credentials to be stored unencrypted in job config.xml files on the Jenkins master. These credentials could be viewed by users with Extended Read permissio...