A missing permission check in Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins….
[com.compuware.jenkins:compuware-zadviser-api] Jenkins Compuware zAdviser API Plugin before 1.0.4 vulnerable to protection mechanism failure
Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties.
References
https://nvd.nist.gov/vuln/de…
[org.jenkins-ci.plugins:http_request] Jenkins HTTP Request Plugin stores HTTP Request passwords unencrypted
Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
References
https://n…
[org.jenkins-ci.plugins:coverity] Jenkins Coverity Plugin allows attackers with Overall/Read permission to enumerate credentials IDs
A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-36919
https://ww…
[org.jenkins-ci.plugins:coverity] Jenkins Coverity Plugin vulnerable to cross-site request forgery (CSRF)
A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials sto…
[com.compuware.jenkins:compuware-topaz-utilities] Jenkins Compuware Topaz Utilities Plugin is missing authorization
A missing permission check in Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins.
Refere…
[org.jenkins-ci.plugins:openshift-deployer] Jenkins OpenShift Deployer Plugin allows connection to attacker-specified URL using attacker-specified credentials
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.
References
https://nvd.nist.gov/vuln/deta…
[org.jenkins-ci.plugins:openstack-heat] Jenkins Openstack Heat Plugin CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attacker-specified URL.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-36911
https://www.jenkins.io/security/adv…
[org.jenkins-ci.plugins:coverity] Jenkins Coverity Plugin is missing authorization, leading to Credential Capture
A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentia…
[org.jenkins-ci.plugins:openshift-deployer] Jenkins OpenShift Deployer Plugin allows attackers to check for file path, upload SSH key file
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file f…