Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-10286 State: PUBLISHED Published: 2019-04-04T15:38:49 Last Updated: 2024-08-04T22:17:19.651Z Vendors: Jenkins project Products: Jenkins DeployHub Plugin Description: Jenkins DeployHub Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-959
CVE ID: CVE-2019-10287 State: PUBLISHED Published: 2019-04-04T15:38:50 Last Updated: 2024-08-04T22:17:19.742Z Vendors: Jenkins project Products: Jenkins youtrack-plugin Plugin Description: Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-963
CVE ID: CVE-2019-10288 State: PUBLISHED Published: 2019-04-04T15:38:50 Last Updated: 2024-08-04T22:17:19.873Z Vendors: Jenkins project Products: Jenkins Jabber Server Plugin Description: Jenkins Jabber Server Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1031
CVE ID: CVE-2019-10289 State: PUBLISHED Published: 2019-04-04T15:38:50 Last Updated: 2024-08-04T22:17:19.848Z Vendors: Jenkins project Products: Jenkins Netsparker Cloud Scan Plugin Description: A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method allowed attackers to initiate a connection to an attacker-specified server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1032
CVE ID: CVE-2019-10290 State: PUBLISHED Published: 2019-04-04T15:38:50 Last Updated: 2024-08-04T22:17:19.687Z Vendors: Jenkins project Products: Jenkins Netsparker Cloud Scan Plugin Description: A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method allowed attackers with Overall/Read permission to initiate a connection to an attacker-specified server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1032
CVE ID: CVE-2019-10291 State: PUBLISHED Published: 2019-04-04T15:38:50 Last Updated: 2024-08-04T22:17:19.793Z Vendors: Jenkins project Products: Jenkins Netsparker Cloud Scan Plugin Description: Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1040
CVE ID: CVE-2019-10292 State: PUBLISHED Published: 2019-04-04T15:38:50 Last Updated: 2024-08-04T22:17:19.821Z Vendors: Jenkins project Products: Jenkins Kmap Plugin Description: A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers to initiate a connection to an attacker-specified server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1055
CVE ID: CVE-2019-10293 State: PUBLISHED Published: 2019-04-04T15:38:50 Last Updated: 2024-08-04T22:17:20.183Z Vendors: Jenkins project Products: Jenkins Kmap Plugin Description: A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1055
CVE ID: CVE-2019-10294 State: PUBLISHED Published: 2019-04-04T15:38:50 Last Updated: 2024-08-04T22:17:19.843Z Vendors: Jenkins project Products: Jenkins Kmap Plugin Description: Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1056
CVE ID: CVE-2019-10295 State: PUBLISHED Published: 2019-04-04T15:38:50 Last Updated: 2024-08-04T22:17:19.707Z Vendors: Jenkins project Products: Jenkins crittercism-dsym Plugin Description: Jenkins crittercism-dsym Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1063
CVE ID: CVE-2019-10296 State: PUBLISHED Published: 2019-04-04T15:38:50 Last Updated: 2024-08-04T22:17:19.623Z Vendors: Jenkins project Products: Jenkins Serena SRA Deploy Plugin Description: Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1066
CVE ID: CVE-2019-10297 State: PUBLISHED Published: 2019-04-04T15:38:50 Last Updated: 2024-08-04T22:17:19.793Z Vendors: Jenkins project Products: Jenkins Sametime Plugin Description: Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1090
CVE ID: CVE-2019-10298 State: PUBLISHED Published: 2019-04-04T15:38:50 Last Updated: 2024-08-04T22:17:19.843Z Vendors: Jenkins project Products: Jenkins Koji Plugin Description: Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1092
CVE ID: CVE-2019-10299 State: PUBLISHED Published: 2019-04-04T15:38:50 Last Updated: 2024-08-04T22:17:19.724Z Vendors: Jenkins project Products: Jenkins CloudCoreo DeployTime Plugin Description: Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-960
CVE ID: CVE-2019-10300 State: PUBLISHED Published: 2019-04-18T16:54:18 Last Updated: 2024-08-04T22:17:19.943Z Vendors: Jenkins project Products: Jenkins GitLab Plugin Description: A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108045 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0788 - https://j
//www.securityfocus.com/bid/108045 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0788 - https://jenkins.io/security/advisory/2019-04-17/#SECURITY-1357
CVE ID: CVE-2019-10301 State: PUBLISHED Published: 2019-04-18T16:54:18 Last Updated: 2024-08-04T22:17:19.852Z Vendors: Jenkins project Products: Jenkins GitLab Plugin Description: A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108045 - https://jenkins.io/security/advisory/2019-04-17/#SECURITY-1357
CVE ID: CVE-2019-10302 State: PUBLISHED Published: 2019-04-18T16:54:18 Last Updated: 2024-08-04T22:17:19.740Z Vendors: Jenkins project Products: Jenkins jira-ext Plugin Description: Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108045 - https://jenkins.io/security/advisory/2019-04-17/#SECURITY-836
CVE ID: CVE-2019-10303 State: PUBLISHED Published: 2019-04-18T16:54:18 Last Updated: 2024-08-04T22:17:19.815Z Vendors: Jenkins project Products: Jenkins Azure PublisherSettings Credentials Plugin Description: Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they could be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108045 - https://jenkins.io/security/advisory/2019-04-17/#SECURITY-844
CVE ID: CVE-2019-10304 State: PUBLISHED Published: 2019-04-18T16:54:18 Last Updated: 2024-08-04T22:17:19.986Z Vendors: Jenkins project Products: Jenkins XebiaLabs XL Deploy Plugin Description: A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers to initiate a connection to an attacker-specified server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108045 - https://jenkins.io/security/advisory/2019-04-17/#SECURITY-983
CVE ID: CVE-2019-10305 State: PUBLISHED Published: 2019-04-18T16:54:18 Last Updated: 2024-08-04T22:17:20.111Z Vendors: Jenkins project Products: Jenkins XebiaLabs XL Deploy Plugin Description: A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108045 - https://jenkins.io/security/advisory/2019-04-17/#SECURITY-983
CVE ID: CVE-2019-10306 State: PUBLISHED Published: 2019-04-18T16:54:18 Last Updated: 2024-08-04T22:17:19.804Z Vendors: Jenkins project Products: Jenkins ontrack Plugin Description: A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execute arbitrary code on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108045 - https://jenkins.io/security/advisory/2019-04-17/#SECURITY-1341
CVE ID: CVE-2019-10307 State: PUBLISHED Published: 2019-04-30T12:25:17 Last Updated: 2024-08-04T22:17:20.355Z Vendors: Jenkins project Products: Jenkins Static Analysis Utilities Plugin Description: A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers to change the per-job default graph configuration for all users. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/30/5 - http://www.securityfocus.com/bid/108159 - https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1100
CVE ID: CVE-2019-10308 State: PUBLISHED Published: 2019-04-30T12:25:17 Last Updated: 2024-08-04T22:17:20.358Z Vendors: Jenkins project Products: Jenkins Static Analysis Utilities Plugin Description: A missing permission check in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers with Overall/Read permission to change the per-job default graph configuration for all users. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/30/5 - http://www.securityfocus.com/bid/108159 - https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1100
CVE ID: CVE-2019-10309 State: PUBLISHED Published: 2019-04-30T12:25:17 Last Updated: 2024-08-04T22:17:20.298Z Vendors: Jenkins project Products: Jenkins Self-Organizing Swarm Plug-in Modules Plugin Description: Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm clients. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/30/5 - http://www.securityfocus.com/bid/108159 - https://www.talosintelligence.com/vuln
l.com/lists/oss-security/2019/04/30/5 - http://www.securityfocus.com/bid/108159 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0783 - https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1252
CVE ID: CVE-2019-10310 State: PUBLISHED Published: 2019-04-30T12:25:17 Last Updated: 2024-08-04T22:17:20.304Z Vendors: Jenkins project Products: Jenkins Ansible Tower Plugin Description: A cross-site request forgery vulnerability in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method allowed attackers permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/30/5 - http://www.secur
Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/30/5 - http://www.securityfocus.com/bid/108159 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0786 - https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1355
CVE ID: CVE-2019-10311 State: PUBLISHED Published: 2019-04-30T12:25:17 Last Updated: 2024-08-04T22:17:20.320Z Vendors: Jenkins project Products: Jenkins Ansible Tower Plugin Description: A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/30/5 - http://www.se
st Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/30/5 - http://www.securityfocus.com/bid/108159 - https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1355
CVE ID: CVE-2019-10312 State: PUBLISHED Published: 2019-04-30T12:25:17 Last Updated: 2024-08-04T22:17:20.282Z Vendors: Jenkins project Products: Jenkins Ansible Tower Plugin Description: A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillTowerCredentialsIdItems method allowed attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/30/5 - http://www.securityfocus.com/bid/108159 - https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1355
CVE ID: CVE-2019-10313 State: PUBLISHED Published: 2019-04-30T12:25:17 Last Updated: 2024-08-04T22:17:20.305Z Vendors: Jenkins project Products: Jenkins Twitter Plugin Description: Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/30/5 - http://www.securityfocus.com/bid/108159 - https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1143
CVE ID: CVE-2019-10314 State: PUBLISHED Published: 2019-04-30T12:25:17 Last Updated: 2024-08-04T22:17:20.379Z Vendors: Jenkins project Products: Jenkins Koji Plugin Description: Jenkins Koji Plugin disables SSL/TLS and hostname verification globally for the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/30/5 - http://www.securityfocus.com/bid/108159 - https://jenkins.io/security/advisory/2019-04-30/#SECURITY-936
CVE ID: CVE-2019-10315 State: PUBLISHED Published: 2019-04-30T12:25:17 Last Updated: 2024-08-04T22:17:20.358Z Vendors: Jenkins project Products: Jenkins GitHub Authentication Plugin Description: Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/30/5 - http://www.securityfocus.com/bid/108159 - https://jenkins.io/security/advisory/2019-04-30/#SECURITY-443
CVE ID: CVE-2019-10316 State: PUBLISHED Published: 2019-04-30T12:25:18 Last Updated: 2024-08-04T22:17:20.428Z Vendors: Jenkins project Products: Jenkins Aqua MicroScanner Plugin Description: Jenkins Aqua MicroScanner Plugin 1.0.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/30/5 - http://www.securityfocus.com/bid/108159 - https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1380
CVE ID: CVE-2019-10317 State: PUBLISHED Published: 2019-04-30T12:25:18 Last Updated: 2024-08-04T22:17:20.492Z Vendors: Jenkins project Products: Jenkins SiteMonitor Plugin Description: Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/30/5 - http://www.securityfocus.com/bid/108159 - https://jenkins.io/security/advisory/2019-04-30/#SECURITY-930
CVE ID: CVE-2019-10318 State: PUBLISHED Published: 2019-04-30T12:25:18 Last Updated: 2024-08-04T22:17:20.469Z Vendors: Jenkins project Products: Jenkins Azure AD Plugin Description: Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/30/5 - http://www.securityfocus.com/bid/108159 - https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1390
CVE ID: CVE-2019-10319 State: PUBLISHED Published: 2019-05-21T13:00:22 Last Updated: 2024-08-04T22:17:20.399Z Vendors: Jenkins project Products: Jenkins PAM Authentication Plugin Description: A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allowed users with Overall/Read permission to obtain limited information about the file /etc/shadow and the user Jenkins is running as. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/05/21/1 - https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1316
CVE ID: CVE-2019-10320 State: PUBLISHED Published: 2019-05-21T13:00:22 Last Updated: 2024-08-04T22:17:20.390Z Vendors: Jenkins project Products: Jenkins Credentials Plugin Description: Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/05/21/1 - http://seclists.org/fulldisclosure/2019/May/39 - http://www.securityfocus.com/bid/108462 - https://wwws.nightwatchcyb
- http://seclists.org/fulldisclosure/2019/May/39 - http://www.securityfocus.com/bid/108462 - https://wwws.nightwatchcybersecurity.com/2019/05/23/exploring-the-file-system-via-jenkins-credentials-plugin-vulnerability-cve-2019-10320/ - https://access.redhat.com/errata/RHBA-2019:1605 - https://access.redhat.com/errata/RHSA-2019:1636 - https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1322
CVE ID: CVE-2019-10321 State: PUBLISHED Published: 2019-05-31T14:20:19 Last Updated: 2024-08-04T22:17:20.507Z Vendors: Jenkins project Products: Jenkins Artifactory Plugin Description: A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/05/31/2 - http://www.securityfocus.com/bid/108540 - https://www
ences: - http://www.openwall.com/lists/oss-security/2019/05/31/2 - http://www.securityfocus.com/bid/108540 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0787 - https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1015%20%281%29