Ecosystem
Maven
7,126 known vulnerabilities.
Most affected packages
3,448 results · Clear filters · Feed
-
Medium 4.3
Jenkins Klaros-Testmanagement Plugin stores credentials in plain text
Jenkins Klaros-Testmanagement Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins DeployHub Plugin stores credentials in plain text
Jenkins DeployHub Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 6.5
Missing permission check in Jenkins VMware Lab Manager Slaves Plugin
A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
-
Medium 6.5
CSRF vulnerability in Jenkins FTP publisher Plugin
A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers to initiate a connection to an attacker-specified server.
-
Medium 4.3
Jenkins CloudFormation Plugin stores credentials in plain text
Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins wildFly Deployer Plugin stores credentials in plain text
Jenkins WildFly Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins VS Team Services Continuous Deployment Plugin stores credentials in plain text
Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins WebSphere Deployer Plugin stores credentials in plain text
Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 6.5
Missing permission check in Jenkins Audit to Database Plugin
A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
-
Medium 6.5
CSRF vulnerability in Jenkins Gearman Plugin
A cross-site request forgery vulnerability in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
-
Medium 6.5
Missing permission check in Jenkins FTP publisher Plugin
A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
-
Medium 6.5
CSRF vulnerability in Jenkins Audit to Database Plugin
A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
-
Medium 6.5
Jenkins VMware Lab Manager Slaves Plugin vulnerable CSRF vulnerability
A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
-
Medium 6.5
CSRF vulnerability in Jenkins OpenShift Deployer Plugin
A cross-site request forgery vulnerability in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation method allows attackers to initiate a connection to an attacker-specified server.
-
Medium 6.5
CSRF vulnerability in Jenkins OpenShift Deployer Plugin
A missing permission check in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
-
Medium 4.3
Jenkins VMware vRealize Automation Plugin Missing Encryption of Sensitive Data
Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Trac Publisher Plugin stores credentials in plain text
Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 4.3
Jenkins Jira Issue Updater Plugin stores credentials in plain text
Jenkins Jira Issue Updater Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 5.9
Improper Validation of Certificate with Host Mismatch in Shibboleth Identity Provider and OpenSAML Java
The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName fie…
-
Medium 6.1
Moderate severity vulnerability that affects org.apache.jspwiki:jspwiki-main
In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on i…
-
Medium 6.5
ECS Publisher Plugin stored and displayed API token in plain text
A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenkins home directory to obtain the API token configured in this plugin's configuration.
-
Medium 4.2
Jenkins Slack Notification Plugin missing permission check
A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credenti…
-
Medium 5.4
Jenkins Lockable Resources Plugin XSS vulnerability
A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.
-
Medium 6.5
SSRF vulnerability due to missing permission check in Fortify on Demand Uploader Plugin
A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
-
Medium 6.5
Jenkins Fortify on Demand Uploader Plugin CSRF vulnerability
A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an attacker-specified server.
-
Medium 6.5
Moderate severity vulnerability that affects org.apache.karaf:apache-karaf and org.apache.karaf:karaf
Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validat…
-
Medium 5.3
Moderate severity vulnerability that affects com.puppycrawl.tools:checkstyle
Checkstyle before 8.18 loads external DTDs by default.
-
Medium 4.3
Missing permission check in Azure VM Agents Plugin allowed modifying VM configuration
A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgent.java that allows attackers with Overall/Read permission to attach a public IP address to an Azure VM agent.
-
Medium 4.3
Information disclosure in Azure VM Agents Plugin
An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgentTemplate.java, src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java that allows attackers with Ove…
-
Medium 6.5
Unprivileged users with Overall/Read access are able to enumerate credential IDs in Azure VM Agents Plugin
An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java that allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stor…
-
Medium 4.3
Jenkins AppDynamics Dashboard Plugin has insufficiently protected credentials
An insufficiently protected credentials vulnerability exists in JenkinsAppDynamics Dashboard Plugin 1.0.14 and earlier in src/main/java/nl/codecentric/jenkins/appd/AppDynamicsResultsPublisher.java that allows attackers without permission to obtain passwords c…
-
Medium 6.5
Open Redirect in spring-security-oauth2
Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user…
-
Medium 6.1
Moderate severity vulnerability that affects org.b3log:symphony
An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java.
-
Medium 4.3
SSRF vulnerability due to missing permission check in Jenkins JMS Messaging Plugin
A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthenticationMethod.java that allows attackers with Overall/Read permission to have Jenkins connect to a …
-
Medium 4.3
Jenkins Cloud Foundry Plugin vulnerable to exposure of sensitive information
A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specifi…
-
Medium 4.3
SSRF vulnerability due to missing permission check in Jenkins OctopusDeploy Plugin
A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL and obtain the HTTP respon…
-
Medium 4.3
Jenkins Mattermost Notification Plugin vulnerable to SSRF
A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and…
-
Medium 6.1
Bootstrap Vulnerable to Cross-Site Scripting
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
-
Medium 6.1
Cross-site Scripting in jspwiki-war
A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking.
-
Medium 4.3
Cross-Site Request Forgery in Jenkins Git Plugin
A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record.