CSRF vulnerability and missing permission checks in Black Duck Hub Plugin allowed server-side request forgery, capturing credentials

Black Duck Hub Plugin did not perform permission checks on methods implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

CloudBees Jenkins S3 Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version release/testing projects and some timed tasks . S3 Plugin is used in one of the...

Perforce Plugin uses ineffective credentials encryption

Perforce Plugin encrypts its credentials using DES and an encryption key stored in its public source code, so it only serves as basic obfuscation. This allowed users with Jenkins controller local file system access and Jenkins administrators to retrieve the stored password. The latter could resul...

Coverity Plugin stored keystore and private key passwords in plain text

The Coverity Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins controller local file system access and Jenkins administrators to retrieve the stored password. The latter could result in exposure of the passwords through browser extensions, cross-sit...

Disclosure of user names and node names to unauthorized users through post-commit hook URL in Subversion Plugin

The class handling unauthenticated Subversion post-commit hook notification requests at the /subversion/ path unnecessarily extended another type that handled requests to the …/search/ sub-path. This allowed submission of search queries to Jenkins, and getting a list of search results usually...

OWASP DependencyCheck - A Software Composition Analysis Utility That Detects Publicly Disclosed Vulnerabilities In Application Dependencies

Dependency-Check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration CPE identifier for a given dependency. If found, it will generate a report linking to the associate...

PYSEC-2017-4

A flaw was found in the way Ansible 2.3.x before 2.3.3, and 2.4.x before 2.4.1 passed certain parameters to the jenkinsplugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in th...

DEBIAN-CVE-2017-7550

A flaw was found in the way Ansible 2.3.x before 2.3.3, and 2.4.x before 2.4.1 passed certain parameters to the jenkinsplugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in th...

UBUNTU-CVE-2017-7550

A flaw was found in the way Ansible 2.3.x before 2.3.3, and 2.4.x before 2.4.1 passed certain parameters to the jenkinsplugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in th...

CVE-2017-7550

A flaw was found in the way Ansible 2.3.x before 2.3.3, and 2.4.x before 2.4.1 passed certain parameters to the jenkinsplugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in th...

PT-2017-17794

Name of the Vulnerable Software and Affected Versions Ansible versions 2.3.x through 2.3.2 Ansible versions 2.4.x through 2.4.0 Description A flaw was found in the way Ansible passed certain parameters to the jenkins plugin module, allowing remote attackers to expose sensitive information from a...

OWASP ZAP 2.6.0 - Penetration Testing Tool for Testing Web Applications

The OWASP Zed Attack Proxy ZAP is one of the world’s most popular free security tools and is actively maintained by hundreds of international volunteers. It can help you automatically find security vulnerabilities in your web applications while you are developing and testing your applications. It...

[SECURITY] Fedora 24 Update: jenkins-junit-plugin-1.12-1.fc24

This package provides Jenkins plugin which allows JUnit-format test results to be published...

[SECURITY] Fedora 21 Update: jenkins-matrix-project-plugin-1.4-3.fc21

This package provides Jenkins plugin which adds support for Multi-configuration matrix project type...

[SECURITY] Fedora 21 Update: jenkins-junit-plugin-1.2-1.fc21

This package provides Jenkins plugin which allows JUnit-format test results to be published...

[SECURITY] Fedora 21 Update: jenkins-external-monitor-job-plugin-1.4-1.fc21

This package provides Jenkins plugin which adds the ability to monitor the result of externally executed jobs...

[SECURITY] Fedora 21 Update: jenkins-icon-shim-1.0.4-1.fc21

A "shim" plugin that allows plugins make use of the core icon tag, while still remaining backward compatible with older versions of Jenkins core that do not have the icon tag...

CVE-2013-5676

The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information cleartext passwords by reading the value in the sonar.sonarPassword parameter from jenkins/configure...

CVE-2013-5676: Undefined Security Weakness

The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information cleartext passwords by reading the value in the sonar.sonarPassword parameter from jenkins/configure...

PT-2013-5722

Name of the Vulnerable Software and Affected Versions Jenkins Plugin for SonarQube versions 3.7 and earlier Description The issue allows remote authenticated users to obtain sensitive information, specifically cleartext passwords, by reading the value in the sonarPassword parameter from the...