CVE-2021-21681

Jenkins Nomad Plugin prior to version 0.7.5 stores Docker registry credentials in plaintext in the global config.xml on the Jenkins controller, exposing them to any user with file-system access. This CVE (CVE-2021-21681) affects 0.7.4 and earlier. Root cause is unencrypted storage of passwords in...

CVE-2019-1003092

The CVE-2019-1003092 entry concerns a cross-site request forgery in the Jenkins Nomad Plugin, specifically in the NomadCloud.DescriptorImpl#doTestConnection form validation. The vulnerability allows an attacker to cause the plugin to initiate a connection to a server of the attacker’s choosing. D...

CVE-2019-1003093

CVE-2019-1003093 corresponds to a Jenkins Nomad Plugin issue where a missing permission check in NomadCloud.DescriptorImpl#doTestConnection allows attackers with Overall/Read to initiate a connection to a server chosen by the attacker. The vulnerability affects the Jenkins Nomad Plugin; impact de...