CVE-2019-10350

Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10348

Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10347

Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system...

Design/Logic Flaw

Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

Design/Logic Flaw

Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

Design/Logic Flaw

Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10348

Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10350

Summary: CVE-2019-10350 affects the CloudBees/Jenkins Port Allocator Plugin. The vulnerability stems from credentials being stored in plaintext in job config.xml files on the Jenkins master, enabling disclosure to users with Extended Read permission or with access to the master filesystem. The CV...

CVE-2019-10350

Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10347

Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system...

Redis is not authorized to access high-risk vulnerability alerts-a vulnerability alert-the black bar safety net

Recently, Sangfor security team found that open-source databases Redis broke up an unauthorized access vulnerability, the first time for tracking and analysis of early warning. The study found that the use of the vulnerability, the attacker can achieve rally shell for arbitrary code execution...

PT-2019-11750 · Jenkins · Jenkins Caliper Ci Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Caliper CI Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within job config.xml files on the Jenkins master or controller. These credentials can be accessed b...

PT-2019-11749 · Jenkins · Jenkins Port Allocator Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Port Allocator Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted form within job config.xml files on the Jenkins master or controller. These credentials can be accessed...

PT-2019-11746 · Jenkins · Jenkins Mashup Portlets Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Mashup Portlets Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner on the Jenkins master, making them accessible to users with file system access. Recommendations...

Master VM Gets Error "The Trust Relatioship Between This Workstation and The Primary Domain Failed" When Trying to Logon to it Using a Domain Account

When trying to log on to master VM using a domain account right after capturing a vDisk from it, an admin user gets error "The trust relationship between this workstation and the primary domain failed." Resetting or deleting and recreating machine account from PVS console does not resolve issue...

FreeBSD : powerdns -- multiple vulnerabilities (1c21f6a3-9415-11e9-95ec-6805ca2fa271)

PowerDNS Team reports : CVE-2019-10162: An issue has been found in PowerDNS Authoritative Server allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit wh...

jenkins-credentials-plugin: Certificate file read vulnerability in Credentials Plugin (SECURITY-1322)

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS12 certificate...

Sharing the Secrets: Pwning an industrial IoT router

I get involved in a lot of IoT and ICS pen tests and found an interesting device on one of them. I didn’t have enough time on the job to go as deep as I wanted, so got PTP to buy a couple to play with. eBay FTW! It’s an Ewon Flexy IoT Router. It’s important to note that local access / public IP...

CVE-2019-10329

Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-10329

Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...