CVE-2019-10368

The CVE-2019-10368 vulnerability affects the Jenkins JClouds Plugin (versions 2.14 and earlier). A cross-site request forgery exists in the form validation paths BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection, where an attacker with Overall/Read ...

CVE-2019-10368

A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpldoTestConnection and JCloudsCloud.DescriptorImpldoTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified...

CVE-2019-10369

CVE-2019-10369 — Jenkins JClouds Plugin : A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection allows users with Overall/Read access to connect to an attacker-specified URL using ...

CSRF vulnerability and missing permission check in jclouds-jenkins allowed capturing credentials

jclouds-jenkins did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

CVE-2019-10368: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpldoTestConnection and JCloudsCloud.DescriptorImpldoTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified...

PT-2019-11765 · Jenkins · Jenkins Jclouds Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JClouds Plugin versions 2.14 and earlier Description: A missing permission check in the Jenkins JClouds Plugin allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs,...

PT-2019-11764 · Jenkins · Jenkins Jclouds Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JClouds Plugin versions 2.14 and earlier Description: A cross-site request forgery issue allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing...

CVE-2019-10369: Missing Authorization

A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpldoTestConnection and JCloudsCloud.DescriptorImpldoTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained...

Incorrect Mapping Of Security Rules

Apache jclouds incorrectly maps the security rules. The vulnerability exists because it arbitrarily assigns security access to any security group found first in the find, leading to incorrect assigning the security rules...

CVE-2014-4651

It was found that the jclouds scriptbuilder Statements class wrote a temporary file to a predictable location. An attacker could use this flaw to access sensitive data, cause a denial of service, or perform other attacks...