Authorization Token stored in plain text by openshift-pipeline

openshift-pipeline 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These token can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of...

PT-2025-1048 · Microsoft · Windows Telephony Service +1

Name of the Vulnerable Software and Affected Versions: Windows Telephony Service affected versions not specified Description: The issue is related to a remote code execution vulnerability in the Windows Telephony Service. It involves a buffer overflow in dynamic memory, which can be exploited by ...

PT-2024-6240 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a denial-of-service vulnerability in the Windows Networking service, which is caused by a null pointer dereference. This could allow a remote attacker to cause a...

PT-2024-37679 · Axis · Axis Os

Name of the Vulnerable Software and Affected Versions: AXIS OS affected versions not specified Description: The VAPIX API alwaysmulti.cgi is vulnerable to file globbing, which could lead to resource exhaustion of the Axis device. The issue was discovered by Marinus Pfund, a member of the AXIS OS...

Credentials stored in plain text by whitesource

whitesource 19.1.1 and earlier stores credentials in plain text as part of its global configuration file org.whitesource.jenkins.pipeline.WhiteSourcePipelineStep.xml and job config.xml files on the Jenkins controller. These credentials could be viewed by users with Extended Read permission in the...

koji globally and unconditionally disables SSL/TLS certificate validation

koji unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM. As of publication of this advisory, there is no fix...