Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-10432 State: PUBLISHED Published: 2019-10-01T13:45:19 Last Updated: 2024-08-04T22:24:17.560Z Vendors: Jenkins project Products: Jenkins HTML Publisher Plugin Description: Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1590 - http://www.openwall.com/lists/oss-security/2019/10/01/2 - https://access.redhat.com/errata/RHSA-2019:4097 - https://access.redhat.com/errata/RHSA-2019:4055 - https:/
19/10/01/2 - https://access.redhat.com/errata/RHSA-2019:4097 - https://access.redhat.com/errata/RHSA-2019:4055 - https://access.redhat.com/errata/RHSA-2019:4089
CVE ID: CVE-2019-10433 State: PUBLISHED Published: 2019-10-01T13:45:20 Last Updated: 2024-08-04T22:24:18.588Z Vendors: Jenkins project Products: Jenkins Dingding[钉钉] Plugin Description: Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1423 - http://www.openwall.com/lists/oss-security/2019/10/01/2 - https://www.zerodayinitiative.com/advisories/ZDI-19-862/
CVE ID: CVE-2019-10434 State: PUBLISHED Published: 2019-10-01T13:45:20 Last Updated: 2024-08-04T22:24:18.039Z Vendors: Jenkins project Products: Jenkins LDAP Email Plugin Description: Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1515 - http://www.openwall.com/lists/oss-security/2019/10/01/2
CVE ID: CVE-2019-10435 State: PUBLISHED Published: 2019-10-01T13:45:20 Last Updated: 2024-08-04T22:24:18.598Z Vendors: Jenkins project Products: Jenkins SourceGear Vault Plugin Description: Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1524 - http://www.openwall.com/lists/oss-security/2019/10/01/2
CVE ID: CVE-2019-10436 State: PUBLISHED Published: 2019-10-16T13:00:44 Last Updated: 2024-08-04T22:24:18.704Z Vendors: Jenkins project Products: Jenkins Google OAuth Credentials Plugin Description: An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1583
CVE ID: CVE-2019-10437 State: PUBLISHED Published: 2019-10-16T13:00:44 Last Updated: 2024-08-04T22:24:18.489Z Vendors: Jenkins project Products: Jenkins CRX Content Package Deployer Plugin Description: A cross-site request forgery vulnerability in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1006%20%281%29
CVE ID: CVE-2019-10438 State: PUBLISHED Published: 2019-10-16T13:00:45 Last Updated: 2024-08-04T22:24:18.485Z Vendors: Jenkins project Products: Jenkins CRX Content Package Deployer Plugin Description: A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1006%20%281%29
CVE ID: CVE-2019-10439 State: PUBLISHED Published: 2019-10-16T13:00:45 Last Updated: 2024-08-04T22:24:17.977Z Vendors: Jenkins project Products: Jenkins CRX Content Package Deployer Plugin Description: A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1006%20%282%29
CVE ID: CVE-2019-10440 State: PUBLISHED Published: 2019-10-16T13:00:46 Last Updated: 2024-08-04T22:24:18.022Z Vendors: Jenkins project Products: Jenkins NeoLoad Plugin Description: Jenkins NeoLoad Plugin 2.2.5 and earlier stored credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1427 - http://www.openwall.com/lists/oss-security/2019/10/16/6 - https://www.zerodayinitiative.com/advisories/ZDI-19-932/
CVE ID: CVE-2019-10441 State: PUBLISHED Published: 2019-10-16T13:00:46 Last Updated: 2024-08-04T22:24:18.342Z Vendors: Jenkins project Products: Jenkins iceScrum Plugin Description: A cross-site request forgery vulnerability in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1484
CVE ID: CVE-2019-10442 State: PUBLISHED Published: 2019-10-16T13:00:47 Last Updated: 2024-08-04T22:24:18.037Z Vendors: Jenkins project Products: Jenkins iceScrum Plugin Description: A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1484 - http://www.openwall.com/lists/oss-security/2019/10/16/6
CVE ID: CVE-2019-10443 State: PUBLISHED Published: 2019-10-16T13:00:47 Last Updated: 2024-08-04T22:24:17.946Z Vendors: Jenkins project Products: Jenkins iceScrum Plugin Description: Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1436 - http://www.openwall.com/lists/oss-security/2019/10/16/6 - https://www.zerodayinitiative.com/advisories/ZDI-19-933/
CVE ID: CVE-2019-10444 State: PUBLISHED Published: 2019-10-16T13:00:47 Last Updated: 2024-08-04T22:24:18.234Z Vendors: Jenkins project Products: Jenkins Bumblebee HP ALM Plugin Description: Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1481
CVE ID: CVE-2019-10445 State: PUBLISHED Published: 2019-10-16T13:00:48 Last Updated: 2024-08-04T22:24:18.540Z Vendors: Jenkins project Products: Jenkins Google Kubernetes Engine Plugin Description: A missing permission check in Jenkins Google Kubernetes Engine Plugin 0.7.0 and earlier allowed attackers with Overall/Read permission to obtain limited information about the scope of a credential with an attacker-specified credentials ID. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1607 - http://www.openwall.com/lists/oss-security/2019/10/16/6
CVE ID: CVE-2019-10446 State: PUBLISHED Published: 2019-10-16T13:00:48 Last Updated: 2024-08-04T22:24:18.510Z Vendors: Jenkins project Products: Jenkins Cadence vManager Plugin Description: Jenkins Cadence vManager Plugin 2.7.0 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1615
CVE ID: CVE-2019-10447 State: PUBLISHED Published: 2019-10-16T13:00:49 Last Updated: 2024-08-04T22:24:18.229Z Vendors: Jenkins project Products: Jenkins Sofy.AI Plugin Description: Jenkins Sofy.AI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1431 - http://www.openwall.com/lists/oss-security/2019/10/16/6
CVE ID: CVE-2019-10448 State: PUBLISHED Published: 2019-10-16T13:00:49 Last Updated: 2024-08-04T22:24:18.587Z Vendors: Jenkins project Products: Jenkins Extensive Testing Plugin Description: Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1432
CVE ID: CVE-2019-10449 State: PUBLISHED Published: 2019-10-16T13:00:50 Last Updated: 2024-08-04T22:24:17.953Z Vendors: Jenkins project Products: Jenkins Fortify on Demand Plugin Description: Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1433
CVE ID: CVE-2019-10450 State: PUBLISHED Published: 2019-10-16T13:00:51 Last Updated: 2024-08-04T22:24:18.579Z Vendors: Jenkins project Products: Jenkins ElasticBox CI Plugin Description: Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1434
CVE ID: CVE-2019-10451 State: PUBLISHED Published: 2019-10-16T13:00:51 Last Updated: 2024-08-04T22:24:18.441Z Vendors: Jenkins project Products: Jenkins SOASTA CloudTest Plugin Description: Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1439
CVE ID: CVE-2019-10452 State: PUBLISHED Published: 2019-10-16T13:00:51 Last Updated: 2024-08-04T22:24:18.634Z Vendors: Jenkins project Products: Jenkins View26 Test-Reporting Plugin Description: Jenkins View26 Test-Reporting Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1440
CVE ID: CVE-2019-10453 State: PUBLISHED Published: 2019-10-16T13:00:52 Last Updated: 2024-08-04T22:24:17.977Z Vendors: Jenkins project Products: Jenkins Delphix Plugin Description: Jenkins Delphix Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1450 - http://www.openwall.com/lists/oss-security/2019/10/16/6
CVE ID: CVE-2019-10454 State: PUBLISHED Published: 2019-10-16T13:00:53 Last Updated: 2024-08-04T22:24:18.507Z Vendors: Jenkins project Products: Jenkins Rundeck Plugin Description: A cross-site request forgery vulnerability in Jenkins Rundeck Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1460
CVE ID: CVE-2019-10455 State: PUBLISHED Published: 2019-10-16T13:00:53 Last Updated: 2024-08-04T22:24:18.470Z Vendors: Jenkins project Products: Jenkins Rundeck Plugin Description: A missing permission check in Jenkins Rundeck Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1460
CVE ID: CVE-2019-10456 State: PUBLISHED Published: 2019-10-16T13:00:54 Last Updated: 2024-08-04T22:24:18.693Z Vendors: Jenkins project Products: Jenkins Oracle Cloud Infrastructure Compute Classic Plugin Description: A cross-site request forgery vulnerability in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1462
CVE ID: CVE-2019-10457 State: PUBLISHED Published: 2019-10-16T13:00:54 Last Updated: 2024-08-04T22:24:18.871Z Vendors: Jenkins project Products: Jenkins Oracle Cloud Infrastructure Compute Classic Plugin Description: A missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1462 - http://www.openwall.com/lists/oss-security/2019/10/16/6
CVE ID: CVE-2019-10458 State: PUBLISHED Published: 2019-10-16T13:00:54 Last Updated: 2024-08-04T22:24:18.522Z Vendors: Jenkins project Products: Jenkins Puppet Enterprise Pipeline Description: Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-16/#SECURITY-918
CVE ID: CVE-2019-10459 State: PUBLISHED Published: 2019-10-23T12:45:37 Last Updated: 2024-08-04T22:24:18.538Z Vendors: Jenkins project Products: Jenkins Mattermost Notification Plugin Description: Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1628 - http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE ID: CVE-2019-10460 State: PUBLISHED Published: 2019-10-23T12:45:38 Last Updated: 2024-08-04T22:24:18.540Z Vendors: Jenkins project Products: Jenkins Bitbucket OAuth Plugin Description: Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1546 - http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE ID: CVE-2019-10461 State: PUBLISHED Published: 2019-10-23T12:45:38 Last Updated: 2024-08-04T22:24:18.520Z Vendors: Jenkins project Products: Jenkins Dynatrace Application Monitoring Plugin Description: Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1477 - http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE ID: CVE-2019-10462 State: PUBLISHED Published: 2019-10-23T12:45:39 Last Updated: 2024-08-04T22:24:18.554Z Vendors: Jenkins project Products: Jenkins Dynatrace Application Monitoring Plugin Description: A cross-site request forgery vulnerability in Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1483%20%281%29 - http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE ID: CVE-2019-10463 State: PUBLISHED Published: 2019-10-23T12:45:39 Last Updated: 2024-08-04T22:24:18.511Z Vendors: Jenkins project Products: Jenkins Dynatrace Application Monitoring Plugin Description: A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1483%20%282%29 - http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE ID: CVE-2019-10464 State: PUBLISHED Published: 2019-10-23T12:45:40 Last Updated: 2024-08-04T22:24:18.596Z Vendors: Jenkins project Products: Jenkins Deploy WebLogic Plugin Description: A cross-site request forgery vulnerability in Jenkins Deploy WebLogic Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials, or determine whether a file or directory with an attacker-specified path exists on the Jenkins master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-820 - http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE ID: CVE-2019-10465 State: PUBLISHED Published: 2019-10-23T12:45:40 Last Updated: 2024-08-04T22:24:18.548Z Vendors: Jenkins project Products: Jenkins Deploy WebLogic Plugin Description: A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials, or determine whether a file or directory with an attacker-specified path exists on the Jenkins master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-820 - http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE ID: CVE-2019-10466 State: PUBLISHED Published: 2019-10-23T12:45:41 Last Updated: 2024-08-04T22:24:18.562Z Vendors: Jenkins project Products: Jenkins 360 FireLine Plugin Description: An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-822 - http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE ID: CVE-2019-10467 State: PUBLISHED Published: 2019-10-23T12:45:41 Last Updated: 2024-08-04T22:24:18.595Z Vendors: Jenkins project Products: Jenkins Sonar Gerrit Plugin Description: Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1003 - http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE ID: CVE-2019-10468 State: PUBLISHED Published: 2019-10-23T12:45:42 Last Updated: 2024-08-04T22:24:18.585Z Vendors: Jenkins project Products: Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin Description: A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1005%20%281%29 - http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE ID: CVE-2019-10469 State: PUBLISHED Published: 2019-10-23T12:45:42 Last Updated: 2024-08-04T22:24:18.610Z Vendors: Jenkins project Products: Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin Description: A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1005%20%281%29 - http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE ID: CVE-2019-10470 State: PUBLISHED Published: 2019-10-23T12:45:43 Last Updated: 2024-08-04T22:24:18.555Z Vendors: Jenkins project Products: Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin Description: A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1005%20%282%29 - http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE ID: CVE-2019-10471 State: PUBLISHED Published: 2019-10-23T12:45:43 Last Updated: 2024-08-04T22:24:18.573Z Vendors: Jenkins project Products: Jenkins Libvirt Slaves Plugin Description: A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1014%20%281%29 - http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE ID: CVE-2019-10472 State: PUBLISHED Published: 2019-10-23T12:45:44 Last Updated: 2024-08-04T22:24:18.621Z Vendors: Jenkins project Products: Jenkins Libvirt Slaves Plugin Description: A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1014%20%281%29 - http://www.openwall.com/lists/oss-security/2019/10/23/2