Design/Logic Flaw

Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system...

CVE-2020-2249

Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system...

CVE-2020-2249

CVE-2020-2249 affects Jenkins Team Foundation Server Plugin versions 5.157.1 and earlier, where a webhook secret is stored unencrypted in the plugin’s global configuration file (hudson.plugins.tfs.TeamPluginGlobalConfig.xml) on the Jenkins controller file system. This allows attackers with local ...

CVE-2020-2249

Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system...

CVE-2020-2249

Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system...

PT-2020-15473 · Jenkins · Jenkins Team Foundation Server Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Team Foundation Server Plugin versions 5.157.1 and earlier Description: The issue concerns the storage of a webhook secret in an unencrypted form within the global configuration file on the Jenkins controller. Specifically, the secret...

CVE-2020-2249: Missing Encryption of Sensitive Data

Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system...

Credentials stored in plain text by tfs

tfs 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file hudson.plugins.tfs.TeamPluginGlobalConfig.xml on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with access to the Jenkins controller file system. As of...

Malicious Package

fallguys is a malicious package. Malicious code within the library attempts to read local system files and exfiltrate information through a Discord webhook. The code attempts to access various files on Windows systems such as...

Malicious Package

Overview fallguys contained malicious code that attempted to read local sensitive files and exfiltrate information through a Discord webhook. The code attempted to access the following paths available on Windows systems: - /AppData/Local/Google/Chrome/User\x20Data/Default/Local\x20Storage/leveldb...

CVE-2020-12759

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

CVE-2020-12759

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

Cross site scripting

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

CVE-2020-12759

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

CVE-2020-12759

CVE-2020-12759 affects Zulip Server prior to 2.1.5, with a reflected XSS vulnerability via the Dropbox webhook. Public records across NVD/Red Hat OSV/CVE entries confirm the issue in Zulip Server before 2.1.5 and indicate the root cause as unsafe handling of the webhook payload leading to cross-s...

CVE-2020-12759

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

Zulip Server Cross-Site Scripting Vulnerability (CNVD-2020-49009)

Zulip is a powerful open source group chat application that combines the immediacy of live chat with the productivity benefits of threaded conversations.Zulip Server is the Zulip server. A reflective cross-site scripting vulnerability exists in Zulip Server versions prior to 2.1.5. An attacker ca...

PT-2020-13249

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 2.1.5 Description The issue allows for reflected XSS via the Dropbox webhook. Recommendations For versions prior to 2.1.5, update to version 2.1.5 or later to resolve the issue...

CVE-2020-12759: Improper Neutralization of Input During Web Page Generation

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

Server-Side Request Forgery (SSRF)

github.com/goharbor/harbor is vulnerable to server-side request forgery SSRF. The vulnerability exists due to a legacy endpoint to test webhook, allowing an attacker with permissions to edit projects to perform a port scan of hosts within the internal network...