5174 matches found
CVE-2019-10460
Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system...
CVE-2019-10460
The CVE-2019-10460 entry concerns the Jenkins Bitbucket OAuth Plugin (versions 0.9 and earlier) that stores credentials in plaintext in the global config.xml on the Jenkins master. Root cause: credentials are written unencrypted and accessible to anyone with master FS access. Impact: exposed cred...
PT-2019-11854 · Jenkins · Jenkins Bitbucket Oauth Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Bitbucket OAuth Plugin versions 0.9 and earlier Jenkins Bitbucket OAuth Plugin prior to 0.10 Description: The issue concerns the storage of credentials in an unencrypted manner in the global config.xml configuration file on the Jenkin...
CloudBees Jenkins Google OAuth Credentials Plugin Arbitrary File Read Vulnerability
CloudBees Jenkins is a set of Java-based development of continuous integration tools . A security vulnerability in CloudBees Jenkins Google OAuth Credentials Plugin allows remote attackers to exploit the vulnerability to submit a special request that can read the contents of system files on the...
CVE-2019-10436
An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master...
CVE-2019-10436
An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master...
Design/Logic Flaw
An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master...
CVE-2019-10436
The CVE-2019-10436 issue affects Jenkins Google OAuth Credentials Plugin up to version 0.9. The vulnerability allows attackers who can configure jobs and credentials in Jenkins to read arbitrary files on the Jenkins master, due to an improper access control path. Public details consistently descr...
CVE-2019-10436
An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master...
PT-2019-11830 · Jenkins · Jenkins Google Oauth Credentials Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Google OAuth Credentials Plugin version 0.9 and earlier Description: The issue allows attackers who can configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master due to an arbitrary file read...
1-Click iPhone and Android Exploits Target Tibetan Users via WhatsApp
A team of Canadian cybersecurity researchers has uncovered a sophisticated and targeted mobile hacking campaign that is targeting high-profile members of various Tibetan groups with one-click exploits for iOS and Android devices. Dubbed Poison Carp by University of Toronto's Citizen Lab, the...
Razer: Race Condition in Oauth 2.0 flow can lead to malicious applications create multiple valid sessions
The tester discovered a flaw in the Razer ID authentication system that could allow multiple access tokens. This was a minor issue but could theoretically have led to extended access due to unexpired tokens. Razer thanks the tester for their diligence. Here is a write-up for similar bug:...
Insecure Randomness
Overview org.apereo.cas:cas-server-support-oauth-core-api is a CAS Server Support OAuth Core API for supporting OAuth within Apereo CAS. Affected versions of this package are vulnerable to Insecure Randomness. A insecure source of randomness is used to generate all of its random values as it reli...
CVE-2019-6788
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure issue 3 of 6. For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the us...
CVE-2019-6788
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure issue 3 of 6. For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the us...
CVE-2019-6788
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure issue 3 of 6. For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the us...
Information disclosure
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure issue 3 of 6. For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the us...
CVE-2019-6788
CVE-2019-6788 affects GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The issue enables an information disclosure via a covert redirect when using GitHub or Bitbucket OAuth integrations, allowing retrieval of a user OAuth token for those serv...
CVE-2019-6788
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure issue 3 of 6. For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the us...
