Default credentials

A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified username and password...

CVE-2020-2215

The CVE-2020-2215 entry concerns a CSRF flaw in Jenkins Zephyr for JIRA Test Management Plugin (versions 1.5 and earlier). The underlying issue is a cross-site request forgery vulnerability that allows attackers to cause the application to connect to an attacker-controlled HTTP server using attac...

CVE-2020-2215

A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified username and password...

PT-2020-15430 · Jenkins · Jenkins Zephyr For Jira Test Management Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Zephyr for JIRA Test Management Plugin versions 1.5 and earlier Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified HTTP server using an attacker-specified username and password...

CloudBees Jenkins Zephyr for JIRA Test Management Plugin Information Disclosure Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . Zephyr for JIRA Test Management Plugin is used...

CVE-2020-2154

Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier stores its credentials in plain text in a global configuration file on the Jenkins master file system...

CVE-2020-2128

Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2020-2128

Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2020-2128

CVE-2020-2128 affects the Jenkins ECX Copy Data Management Plugin (versions ≤ 1.9). The root cause is passwords stored unencrypted in job config.xml on the Jenkins master. This allows disclosure to users with Extended Read permissions or to anyone with master filesystem access. The provided docum...

CVE-2019-11287

A resource-consumption flaw was identified in the rabbitmq-server web management plugin. Utilizing a malicious 'X-Reason' HTTP header, a remote attacker could insert a malicious Erlang format string which will expand and consume heap memory, resulting in a crash. The highest threat from this...

Pivotal Software RabbitMQ Web Management Plugin Resource Management Error Vulnerability

Pivotal Software RabbitMQ is the United States Pivotal Software, Inc. of a set of implementation of the Advanced Message Queuing Protocol AMQP open source message broker software. A resource management error vulnerability exists in the Web Management Plugin in Pivotal Software RabbitMQ. An attack...

DEBIAN-CVE-2019-11287

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be...

Unspecified Vulnerability in CloudBees Jenkins QMetry for JIRA-Test Management Plugin

CloudBees Jenkins Hudson Labs is a set of U.S. CloudBees company based on Java development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . QMetry for JIRA-Test Management Plugin is used in one of...

PT-2019-6093 · Pivotal +3 · Rabbitmq +2

Name of the Vulnerable Software and Affected Versions: Pivotal RabbitMQ versions 3.7.x prior to 3.7.21 Pivotal RabbitMQ versions 3.8.x prior to 3.8.1 RabbitMQ for Pivotal Platform versions 1.16.x prior to 1.16.7 RabbitMQ for Pivotal Platform versions 1.17.x prior to 1.17.4 Description: The issue ...

Design/Logic Flaw

Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

Command injection

Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure...

WordPress pretty-link plugin SQL injection vulnerability

WordPress is the WordPress Foundation's set of blogs using PHP language development guest platform. The platform supports setting up personal blog sites on PHP and MySQL servers. pretty-link is a plugin for adding hyperlinks to web pages. WordPress pretty-link plugin version 1.6.8 before the...

WordPress feature-comments plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. feature-comments is a comment management plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...

CVE-2019-1003085

A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptordoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

Cross site request forgery (csrf)

A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptordoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...