CVE-2025-53663

Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2025-53663

Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2025-53663

CVE-2025-53663 affects Jenkins IBM Cloud DevOps Plugin (versions 2.0.16 and earlier). The vulnerability arises from unencrypted storage of SonarQube authentication tokens in job config.xml on the Jenkins controller, enabling access by users with Item/Extended Read permission or with filesystem ac...

Jenkins plugin IBM Cloud DevOps 安全漏洞

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application software. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. Jenkins plugin A...

CVE-2024-47910

An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A SonarQube user with the Administrator role can modify an existing configuration of a GitHub integration to exfiltrate a pre-signed JWT...

CVE-2024-47911

In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQube users with the administrator role to inject blind SQL commands...

CVE-2020-27986

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it...

CVE-2020-28002

In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication is forced. This allows creating and overwriting public and private projects via the /api/ce/submit endpoint...

CVE-2020-35193

The official sonarqube docker images before alpine Alpine specific contain a blank password for a root user. System using the sonarqube docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

CVE-2019-17579

SonarSource SonarQube before 7.8 has XSS in project links on account/projects...

CVE-2024-23445 vulnerabilities

Vulnerabilities for packages: sonarqube-10...

CVE-2024-37280 vulnerabilities

Vulnerabilities for packages: sonarqube-10...

GHSA-4C7Q-M7HC-PC92 vulnerabilities

Vulnerabilities for packages: sonarqube-10...

GHSA-4Q22-422G-M4PJ vulnerabilities

Vulnerabilities for packages: sonarqube-10...

SonarSource SonarQube Server < 9.9.5 / 10.x < 10.5 GitHub Integration JWT Exfiltration (CVE-2024-47910)

The version of SonarSource SonarQube Server running on the remote host is prior to 9.9.5 or 10.x prior to 10.5. It is, therefore, affected by an information disclosure vulnerability: - A SonarQube user with the Administrator role can modify an existing configuration of a GitHub integration to...

SonarSource SonarQube Server Web Interface Detection

Binary data sonarsourcesonarqubeserverwebdetect.nbin...

SonarSource SonarQube Server < 9.9.4 / 10.x < 10.4 Information Disclosure (CVE-2024-38460)

The version of SonarSource SonarQube Server running on the remote host is prior to 9.9.4 or 10.x prior to 10.4. It is, therefore, affected by an information disclosure vulnerability: - In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are...

GHSA-6V67-2WR5-GVF4 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, sonar-scanner-cli, cassandra-reaper, management-api-for-apache-cassandra-5.0, apache-nifi, management-api-for-apache-cassandra-4.0, akhq, cassandra, hadoop-fips, trino, ontop-fips, dependency-track, zookeeper-fips, sonarqube,...

GHSA-PR98-23F8-JWXV vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, sonar-scanner-cli, cassandra-reaper, management-api-for-apache-cassandra-5.0, apache-nifi, management-api-for-apache-cassandra-4.0, akhq, cassandra, hadoop-fips, trino, ontop-fips, dependency-track, zookeeper-fips, sonarqube,...

CVE-2024-12801 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, sonar-scanner-cli, cassandra-reaper, management-api-for-apache-cassandra-5.0, apache-nifi, management-api-for-apache-cassandra-4.0, akhq, cassandra, hadoop-fips, trino, ontop-fips, dependency-track, zookeeper-fips, sonarqube,...