Ecosystem
Maven
7,126 known vulnerabilities.
Most affected packages
3,448 results · Clear filters · Feed
-
Medium 4.3
Jenkins Global Post Script Plugin missing permission check
A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to the plugin stored on the Jenkins master file system.
-
Medium 6.1
Jenkins build-metrics Plugin reflected cross-site scripting vulnerability
A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
-
Medium 4.3
Jenkins Libvirt Slaves Plugin vlnerable to Credential Enumeration
A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
-
Medium 6.5
Jenkins Libvirt Slaves Plugin vlnerable to Incorrect Default Permissions
A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in …
-
Medium 6.5
Jenkins Kubernetes CI/CD Plugin vulnerable to Credential Enumeration
A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
-
Medium 6.5
Jenkins Kubernetes CI/CD Plugin vulnerable to Improper Authorization
A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credenti…
-
Medium 6.5
Jenkins Sonar Gerrit Plugin stores credentials unencrypted
Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Deploy WebLogic Plugin missing permission check
A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials, or determine whether a file or directory with an attacker-specified path e…
-
Medium 6.5
Jenkins Dynatrace Plugin contains Incorrect Default Permissions
A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
-
Medium 6.5
Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token
Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permissio…
-
Medium 6.8
Reactor Netty authentication leak in redirects
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
-
Medium 4.3
Missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin
A missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
-
Medium 4.3
Jenkins Oracle Cloud Infrastructure Compute Classic Plugin cross-site request forgery vulnerability
A cross-site request forgery vulnerability in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
-
Medium 4.3
Jenkins Rundeck Plugin CSRF vulnerability
A cross-site request forgery vulnerability in Jenkins Rundeck Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
-
Medium 4.3
Missing permission check in Jenkins Rundeck Plugin
A missing permission check in Jenkins Rundeck Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
-
Medium 4.3
Jenkins SOASTA CloudTest Plugin stores API token in plain text
Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Medium 4.3
Jenkins View26 Test-Reporting Plugin stores access token in plain text
Jenkins View26 Test-Reporting Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Fortify on Demand Plugin stores credentials in plain text
Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Sofy.AI Plugin stores API token in plain text
Jenkins Sofy.AI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Missing permission checks in Google Kubernetes Engine Jenkins Plugin
A missing permission check in Jenkins Google Kubernetes Engine Plugin 0.7.0 and earlier allowed attackers with Overall/Read permission to obtain limited information about the scope of a credential with an attacker-specified credentials ID.
-
Medium 4.8
Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation
Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.
-
Medium 4.3
Jenkins iceScrum Plugin vulnerable to Missing Authorization
A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
-
Medium 4.3
Jenkins iceScrum Plugin vulnerable to Cross-site Request Forgery
A cross-site request forgery vulnerability in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials.
-
Medium 4.3
Jenkins CRX Content Package Deployer Plugin subject to credentials enumeration via Missing Authorization
A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
-
Medium 6.5
Jenkins CRX Content Package Deployer Plugin subject to Missing Authorization
A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, captur…
-
Medium 6.5
Improper Limitation of a Pathname to a Restricted Directory in Jenkins Google OAuth Credentials Plugin
An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master.
-
Medium 5.0
Keycloak Unauthenticated Access
A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry…
-
Medium 5.2
Wildfly Authorization Misconfiguration
A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server
-
Medium 4.8
Potential to access user credentials from the log files when debug logging enabled
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
-
Medium 6.1
Cross-site Scripting in Eclipse Mojarra
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
-
Medium 5.4
Jenkins HTML Publisher Plugin vulnerable to Cross-site Scripting
Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those.
-
Medium 5.5
Jenkins GitLab Logo Plugin stores credentials unencrypted
Jenkins GitLab Logo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Medium 5.5
Jenkins NeuVector Vulnerability Scanner Plugin stored credentials in plain text
Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
-
Medium 4.3
Jenkins Google Calendar Plugin has Insufficiently Protected Credentials
Jenkins Google Calendar Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 5.5
Jenkins Gem Publisher Plugin stores credentials as plaintext
Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Medium 5.3
Jenkins Aqua MicroScanner Plugin showed plain text credential in configuration form
Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
-
Medium 4.3
Jenkins Violation Comments to GitLab Plugin has Insufficiently Protected Credentials
Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
-
Medium 4.3
Jenkins Data Theorem Mobile Security: CI/CD Plugin has Insufficiently Protected Credentials
Jenkins Data Theorem: CI/CD Plugin 1.3 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Call Remote Job Plugin has Insufficiently Protected Credentials
Jenkins Call Remote Job Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Git Changelog Plugin has Insufficiently Protected Credentials
Jenkins Git Changelog Plugin 2.17 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.