Code injection

Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

Code injection

Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2019-10428

Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2019-10428

Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2019-10427

Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2019-10428

Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2019-10412

Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2019-10412

CVE-2019-10412 affects the CloudBees/Jenkins Inedo ProGet Plugin up to version 1.2, where credentials configured in the global Jenkins configuration form were transmitted in plain text, exposing sensitive data. The root cause involves the plugin storing a service password (encrypted on disk) but ...

CVE-2019-10411

Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

PT-2019-11808 · Jenkins · Jenkins Git Changelog Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Git Changelog Plugin versions 2.17 and earlier Description: The issue concerns the storage of credentials in an unencrypted manner in job config.xml files on the Jenkins master or controller. Specifically, MediaWiki and Jira passwords...

PT-2019-11805 · Jenkins · Jenkins Inedo Buildmaster Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Inedo BuildMaster Plugin versions 2.4.0 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure...

NetApp ONTAP Select Deploy Information Disclosure Vulnerability (CNVD-2019-43849)

ONTAP Select Deploy is a management utility for deploying and managing ONTAP Select clusters. An information disclosure vulnerability exists in ONTAP Select Deploy. The vulnerability stems from the product transmitting credentials in plain text. An attacker could exploit this vulnerability to...

git-changelog stored credentials in plain text

git-changelog stored MediaWiki and Jira passwords unencrypted in job config.xml files on the Jenkins controller. These passwords could be viewed by users with Extended Read permission, or access to the Jenkins controller file system. git-changelog now stores these passwords encrypted. Existing jo...

assembla stores credentials in plain text

assembla stores the Assembla password unencrypted in its global configuration file jenkins.plugin.assembla.AssemblaProjectProperty.xml on the Jenkins controller. This password can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no...

PT-2019-11806 · Jenkins · Jenkins Inedo Proget Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Inedo ProGet Plugin versions 1.2 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure. Specificall...

PT-2019-11821 · Jenkins · Jenkins Aqua Microscanner Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Aqua MicroScanner Plugin version 1.0.7 and earlier Description: The issue involves the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure...

neuvector-vulnerability-scanner stored credentials in plain text

neuvector-vulnerability-scanner stored registry credentials unencrypted in its global configuration file io.jenkins.plugins.neuvector.NeuVectorBuilder.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system...

inedo-proget showed plain text password in configuration form

inedo-proget stores a service password in its global Jenkins configuration. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting...

violation-comments-to-gitlab stored credentials in plain text

violation-comments-to-gitlab stored API tokens unencrypted in job config.xml files and its global configuration file org.jenkinsci.plugins.jvctgl.ViolationsToGitLabGlobalConfiguration.xml on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or acces...

elOyente stores credentials in plain text

elOyente stores a password unencrypted in its global configuration file com.technicolor.eloyente.ElOyente.xml on the Jenkins controller. This password can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no fix...