CVE-2019-16543

The CVE-2019-16543 entry affects Jenkins Spira Importer Plugin versions 3.2.2 and earlier, where credentials are stored unencrypted in the plugin’s global configuration file on the Jenkins master. This exposes sensitive credentials to anyone with access to the master filesystem. Concretely, the r...

CVE-2019-16543

Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-16543

Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-16544

Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-16542

Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-16542

The vulnerability CVE-2019-16542 affects the Jenkins Anchore Container Image Scanner Plugin (versions ≤ 1.0.19). The underlying issue is that credentials (service password for Anchore.io) are stored in plain text in job config.xml on the Jenkins master, making them readable by users with Extended...

PT-2019-14699 · Jenkins · Jenkins Qmetry For Jira - Test Management Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins QMetry for JIRA - Test Management Plugin versions 1.12 and earlier Description: The issue concerns the storage of credentials in an unencrypted manner in job config.xml files on the Jenkins master or controller. This allows users with...

CVE-2019-16110

The network protocol of Blade Shadow though 2.13.3 allows remote attackers to take control of a Shadow instance and execute arbitrary code by only knowing the victim's IP address, because packet data can be injected into the unencrypted UDP packet stream...

CVE-2010-3292

The updatebad,phishingsites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption e.g., https or digital signature checking which could allow an attacker to replace certain configuration files e.g., phishing whitelist via dns/packet spoofing...

CVE-2010-3292

The updatebad,phishingsites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption e.g., https or digital signature checking which could allow an attacker to replace certain configuration files e.g., phishing whitelist via dns/packet spoofing...

Unspecified Vulnerability in Amazon Ring Video Doorbell

Amazon Ring Video Doorbell is a smart wireless home security doorbell camera that allows users to use to remotely control their doorbell. The Amazon Ring Video Doorbell suffers from a security vulnerability that stems from information shared between the application and the doorbell, including Wi-...

CVE-2019-18800

Viber (up to 11.7.0.5) vulnerable: not all Viber protocol traffic is encrypted. TCP port 4244, packet 9, offset 0x14 exposes cleartext device model, OS version, IMSI, and 20 bytes of udid. An attacker could rewrite the victim's udid (viber_udid) and, after a reg/PIN flow, seize the account. Docum...

containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launc...

The vulnerability of the ZingBox Inspector, a network traffic processor, lies in the unencrypted storage of user credentials, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the ZingBox Inspector network traffic processor is related to the unencrypted storage of user credentials. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2019-10476

Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10476

Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10459

Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10460

Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10467

Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10460

Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system...