Archive

4 November 2020

Vulnerabilities first published on this day (UTC), newest first.

← October 2020 2020 / November /4 December 2020 →

All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

Medium 6.5

CVE-2020-2318

Passwords stored in plain text by Mail Commander Plugin for Jenkins-ci Plugin

Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file syst…

Jenkins Project Jenkins Mail Commander Plugin for Jenkins-ci Plugin org.jenkins-ci.plugins:mailcommander Web / CMS Maven

Nov 4, 2020
Medium 5.4

CVE-2020-2317

Stored XSS vulnerability in Jenkins FindBugs Plugin

Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to Jenkins FindBugs Plugin's post build step.

Jenkins Project Jenkins FindBugs Plugin org.jvnet.hudson.plugins:findbugs Web / CMS Maven

Nov 4, 2020
Medium 5.4

CVE-2020-2316

Stored XSS vulnerability in Jenkins Static Analysis Utilities Plugin

Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Jenkins Project Jenkins Static Analysis Utilities Plugin org.jvnet.hudson.plugins:analysis-core Web / CMS Maven

Nov 4, 2020
Medium 6.5

CVE-2020-2315

XXE vulnerability in Jenkins Visualworks Store Plugin

Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Visualworks Store Plugin org.jenkins-ci.plugins:visualworks-store Web / CMS Maven

Nov 4, 2020
Medium 6.5

CVE-2020-2312

Password written to the build log by Jenkins SQLPlus Script Runner Plugin

Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs.

Jenkins Project Jenkins SQLPlus Script Runner Plugin org.jenkins-ci.plugins:sqlplus-script-runner Web / CMS Maven

Nov 4, 2020
Medium 4.3

CVE-2020-2313

Missing permission checks in Jenkins Azure Key Vault Plugin allow enumerating credentials IDs

A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Jenkins Project Jenkins Azure Key Vault Plugin org.jenkins-ci.plugins:azure-keyvault Web / CMS Maven

Nov 4, 2020
Medium 4.3

CVE-2020-2310

Missing permission checks in Jenkins Ansible Plugin allow enumerating credentials IDs

Missing permission checks in Jenkins Ansible Plugin 1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Jenkins Project Jenkins Ansible Plugin org.jenkins-ci.plugins:ansible Web / CMS Maven

Nov 4, 2020
Medium 4.3

CVE-2020-2311

Missing permission check in Jenkins AWS Global Configuration Plugin allows replacing plugin configuration

A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration.

Jenkins Project Jenkins AWS Global Configuration Plugin io.jenkins.plugins:aws-global-configuration Web / CMS Maven

Nov 4, 2020
Medium 4.3

CVE-2020-2308

Missing Authorization in Jenkins Kubernetes Plugin

A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names.

Jenkins Project Jenkins Kubernetes Plugin org.csanchez.jenkins.plugins:kubernetes Web / CMS Maven

Nov 4, 2020
Medium 4.3

CVE-2020-2307

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin

Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables.

Jenkins Project Jenkins Kubernetes Plugin org.csanchez.jenkins.plugins:kubernetes Web / CMS Maven

Nov 4, 2020
Medium 4.3

CVE-2020-2309

Missing authorization in Jenkins Kubernetes Plugin

A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Jenkins Project Jenkins Kubernetes Plugin org.csanchez.jenkins.plugins:kubernetes Web / CMS Maven

Nov 4, 2020
Medium 4.3

CVE-2020-2306

Missing Authorization in Jenkins Mercurial Plugin

A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.

Jenkins Project Jenkins Mercurial Plugin org.jenkins-ci.plugins:mercurial Web / CMS Maven

Nov 4, 2020
Medium 6.5

CVE-2020-2305

XXE vulnerability in Jenkins Mercurial Plugin

Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Mercurial Plugin org.jenkins-ci.plugins:mercurial Web / CMS Maven

Nov 4, 2020
Medium 6.5

CVE-2020-2304

XXE vulnerability in Jenkins Subversion Plugin

Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Subversion Plugin subversion org.jenkins-ci.plugins:subversion Web / CMS Azure Linux Maven

Nov 4, 2020
Medium 4.3

CVE-2020-2303

CSRF vulnerability in Jenkins Active Directory Plugin

A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified cre…

Jenkins Project Jenkins Active Directory Plugin org.jenkins-ci.plugins:active-directory Web / CMS Maven

Nov 4, 2020
Medium 4.3

CVE-2020-2302

Missing permission check in Jenkins Active Directory Plugin allows accessing domain health check page

A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page.

Jenkins Project Jenkins Active Directory Plugin org.jenkins-ci.plugins:active-directory Web / CMS Maven

Nov 4, 2020
Medium 6.3

CVE-2020-28049

An issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time peri…

sddm sddm sddm Debian Ubuntu Alpine

Nov 4, 2020