neuvector-vulnerability-scanner stored credentials in plain text

neuvector-vulnerability-scanner stored registry credentials unencrypted in its global configuration file io.jenkins.plugins.neuvector.NeuVectorBuilder.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system...

violation-comments-to-gitlab stored credentials in plain text

violation-comments-to-gitlab stored API tokens unencrypted in job config.xml files and its global configuration file org.jenkinsci.plugins.jvctgl.ViolationsToGitLabGlobalConfiguration.xml on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or acces...

call-remote-job-plugin stores credentials in plain text

call-remote-job-plugin stores a password unencrypted in job config.xml files on the Jenkins controller. This password can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. As of publication of this advisory, there is no fix...

gem-publisher stores credentials in plain text

gem-publisher stores an API key unencrypted in its global configuration file net.arangamani.jenkins.gempublisher.GemPublisher.xml on the Jenkins controller. This API key can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no fix...

elOyente stores credentials in plain text

elOyente stores a password unencrypted in its global configuration file com.technicolor.eloyente.ElOyente.xml on the Jenkins controller. This password can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no fix...

NetApp ONTAP Select Deploy Information Disclosure Vulnerability (CNVD-2019-43849)

ONTAP Select Deploy is a management utility for deploying and managing ONTAP Select clusters. An information disclosure vulnerability exists in ONTAP Select Deploy. The vulnerability stems from the product transmitting credentials in plain text. An attacker could exploit this vulnerability to...

CodeScan stores credentials in plain text

CodeScan stores an API key unencrypted in its global configuration file com.villagechief.codescan.jenkins.CodeScanBuilder.xml on the Jenkins controller. This API key can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no fix...

PT-2019-11806 · Jenkins · Jenkins Inedo Proget Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Inedo ProGet Plugin versions 1.2 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure. Specificall...

PT-2019-11821 · Jenkins · Jenkins Aqua Microscanner Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Aqua MicroScanner Plugin version 1.0.7 and earlier Description: The issue involves the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure...

CVE-2019-4566

IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 166627...

CVE-2019-4566

IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 166627...

CVE-2019-4566

IBM Security Key Lifecycle Manager (SKLM) 3.0–3.0.1 stores user credentials in plaintext, readable by a local user. Affected: SKLM on distributed platforms. Root cause: credentials stored unencrypted in storage. Impact: local privilege could expose credentials; CVSS details present in sources (ba...

CVE-2019-4566

IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 166627...

CVE-2019-10090

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victi...

CVE-2019-10090

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victi...

CVE-2019-10090

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victi...

Cross-site Scripting (XSS)

jspwiki-war is vulnerable to cross-site scripting XSS. The vulneability exists through the plain editor section drop-down where html is not escaped...

PT-2019-11427

Name of the Vulnerable Software and Affected Versions: Apache JSPWiki versions prior to 2.11.0.M4 Description: A carefully crafted plugin link invocation could trigger an issue related to the plain editor, allowing an attacker to execute javascript in the victim's browser and potentially obtain...

CVE-2019-10090: Improper Neutralization of Input During Web Page Generation

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victi...

Security Bulletin: IBM Security Key Lifecycle Manager stores password in clear text (CVE-2019-4566)

Summary IBM Security Key Lifecycle Manager stores user credentials in plain in clear text which can be read by a local user. Vulnerability Details CVEID: CVE-2019-4566 DESCRIPTION: IBM Tivoli Key Lifecycle Manager stores user credentials in plain in clear text which can be read by a local user...