Category
Web / CMS
26,784 known vulnerabilities.
840 results · Clear filters · Feed
-
Low 3.1
Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form
Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
-
Low 3.1
Jenkins Aqua Security Serverless Scanner Plugin showed plain text password in job configuration form fields
Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure.
-
Low 3.3
Jenkins Beaker Builder Plugin has Insufficiently Protected Credentials
Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
-
Low 3.3
Jenkins TestLink Plugin stores credentials in plain text
Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Maven Release Plug-in Plugin stored credentials in plain text
Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the master file system.
-
Low 3.1
Moodle Open Redirect Vulnerability
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.
-
Low 3.3
Jenkins Azure AD Plugin stored the client secret unencrypted
Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Aqua MicroScanner Plugin stored credentials in plain text
Jenkins Aqua MicroScanner Plugin 1.0.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Twitter Plugin stores credentials in plain text
Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Azure PublisherSettings Credentials Plugin stored credentials in plain text
Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they could be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Serena SRA Deploy Plugin stores credentials in plain text
Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Koji Plugin stores credentials in plain text
Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins CloudCoreo DeployTime Plugin stores credentials in plain text
Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Netsparker Enterprise Scan Plugin stored credentials in plain text
Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
-
Low 3.3
Jenkins youtrack-plugin Plugin stored credentials in plain text
Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Sametime Plugin stores credentials in plain text
Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Jabber Server Plugin stores credentials in plain text
Jenkins Jabber Server Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Minio Storage Plugin stores credentials in plain text
Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials in plain text
Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Bugzilla Plugin stores credentials in plain text
Jenkins Bugzilla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins aws-device-farm Plugin stores credentials in plain text
Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Aqua Security Scanner Plugin stores credentials in plain text
Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins CloudShare Docker-Machine Plugin stores credentials in plain text
Jenkins CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins OWASP ZAP Plugin stores unencrypted credentials
Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins hyper.sh Commons Plugin stores credentials in plain text
Jenkins Hyper.sh Commons Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Audit to Database Plugin stores credentials in plain text
Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Bitbucket Approve Plugin stores credentials in plain text
Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins veracode-scanner Plugin stores credentials in plain text
Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Amazon SNS Build Notifier Plugin stores credentials in plain text
Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins Octopus Deploy Plugin stores credentials in plain text
Jenkins OctopusDeploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials in plain text
Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials in plain text
Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins IRC Plugin stores credentials in plain text
Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins FTP publisher Plugin stores credentials in plain text
Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
Jenkins PRQA Plugin stored password in plain text
A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtain the unencrypted password from the plugin configuration.
-
Low 3.3
Jenkins Repository Connector Plugin has insufficiently protected credentials
An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnect…
-
Low 3.7
Emails were sent to addresses not associated with actual users of Jenkins by Email Extension Plugin
jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. T…
-
Low 3.7
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins-mailer-plugin
jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have…
-
Low 3.1
Incomplete List of Disallowed Inputs in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents (SECURITY-358).
-
Low 2.6
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362).