CVE-2025-53668

The Jenkins VAddy Plugin (version 1.2.8 and earlier) stores Vaddy API Auth Keys unencrypted in the job config.xml files on the Jenkins controller. Due to this CWE-311 (Missing Encryption of Sensitive Data) flaw, users with Item/Extended Read permissions or those with direct access to the Jenkins ...

CVE-2025-53669

The Jenkins VAddy Plugin (version 1.2.8 and earlier ) fails to mask Vaddy API Auth Keys when they are displayed on the job configuration form. This oversight allows attackers to observe and capture sensitive credentials directly from the user interface. Additionally, the plugin stores these keys ...