Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-1003028 State: PUBLISHED Published: 2019-02-20T21:00:00 Last Updated: 2024-08-05T03:00:19.318Z Vendors: Jenkins project Products: Jenkins JMS Messaging Plugin Description: A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthenticationMethod.java that allows attackers with Overall/Read permission to have Jenkins connect to a JMS endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-02-19/#SECURITY-1033 - http://www.securityfocus.com/bid/107295
CVE ID: CVE-2019-1003029 State: PUBLISHED Published: 2019-03-08T21:00:00.000Z Last Updated: 2025-10-21T23:45:42.215Z Vendors: Jenkins project Products: Jenkins Script Security Plugin Description: A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jenkins.io/security/advisory/2019-
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29 - http://www.securityfocus.com/bid/107476 - https://access.redhat.com/errata/RHSA-2019:0739 - http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html
CVE ID: CVE-2019-1003030 State: PUBLISHED Published: 2019-03-08T21:00:00.000Z Last Updated: 2025-10-21T23:45:42.056Z Vendors: Jenkins project Products: Jenkins Pipeline: Groovy Plugin Description: A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%282%29 - http://www.securityfocus.com/bid/107476 - https://access.re
s.io/security/advisory/2019-03-06/#SECURITY-1336%20%282%29 - http://www.securityfocus.com/bid/107476 - https://access.redhat.com/errata/RHSA-2019:0739 - http://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html
CVE ID: CVE-2019-1003031 State: PUBLISHED Published: 2019-03-08T21:00:00 Last Updated: 2024-08-05T03:00:19.269Z Vendors: Jenkins project Products: Jenkins Matrix Project Plugin Description: A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1339 - http://www.securityfocus.com/bid/107476 - https://access.redhat.com/errata/RHSA-2019:0739
CVE ID: CVE-2019-1003032 State: PUBLISHED Published: 2019-03-08T21:00:00 Last Updated: 2024-08-05T03:00:19.346Z Vendors: Jenkins project Products: Jenkins Email Extension Plugin Description: A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM. Additi
ger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1340 - http://www.securityfocus.com/bid/107476
CVE ID: CVE-2019-1003033 State: PUBLISHED Published: 2019-03-08T21:00:00 Last Updated: 2024-08-05T03:07:16.685Z Vendors: Jenkins project Products: Jenkins Groovy Plugin Description: A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1338 - http://www.securityfocus.com/bid/107476
CVE ID: CVE-2019-1003034 State: PUBLISHED Published: 2019-03-08T21:00:00 Last Updated: 2024-08-05T03:07:16.812Z Vendors: Jenkins project Products: Jenkins Job DSL Plugin Description: A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/SandboxDslScriptLoader.groovy that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Conta
r Job DSL definitions to execute arbitrary code on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1342 - http://www.securityfocus.com/bid/107476 - https://access.redhat.com/errata/RHSA-2019:0739
CVE ID: CVE-2019-1003035 State: PUBLISHED Published: 2019-03-08T21:00:00 Last Updated: 2024-08-05T03:07:18.387Z Vendors: Jenkins project Products: Jenkins Azure VM Agents Plugin Description: An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgentTemplate.java, src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java that allows attackers with Overall/Read permission to perform the 'verify configuration' form validation action, thereby obtaining limited information about the Azure configuration. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advis
Azure configuration. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1330 - http://www.securityfocus.com/bid/107476
CVE ID: CVE-2019-1003036 State: PUBLISHED Published: 2019-03-08T21:00:00 Last Updated: 2024-08-05T03:07:16.789Z Vendors: Jenkins project Products: Jenkins Azure VM Agents Plugin Description: A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgent.java that allows attackers with Overall/Read permission to attach a public IP address to an Azure VM agent. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1331 - http://www.securityfocus.com/bid/107476
CVE ID: CVE-2019-1003037 State: PUBLISHED Published: 2019-03-08T21:00:00 Last Updated: 2024-08-05T03:07:17.916Z Vendors: Jenkins project Products: Jenkins Azure VM Agents Plugin Description: An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java that allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1332 - http://www.securityfocus.com/bid/107476
CVE ID: CVE-2019-1003038 State: PUBLISHED Published: 2019-03-08T21:00:00 Last Updated: 2024-08-05T03:07:16.687Z Vendors: Jenkins project Products: Jenkins Repository Connector Plugin Description: An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/UserPwd.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the pass
l file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the password stored in the plugin configuration. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-03-06/#SECURITY-958 - http://www.securityfocus.com/bid/107476
CVE ID: CVE-2019-1003039 State: PUBLISHED Published: 2019-03-08T21:00:00 Last Updated: 2024-08-05T03:07:16.679Z Vendors: Jenkins project Products: JenkinsAppDynamics Dashboard Plugin Description: An insufficiently protected credentials vulnerability exists in JenkinsAppDynamics Dashboard Plugin 1.0.14 and earlier in src/main/java/nl/codecentric/jenkins/appd/AppDynamicsResultsPublisher.java that allows attackers without permission to obtain passwords configured in jobs to obtain them. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1087 - http://www.securityfocus.com/bid/107476
CVE ID: CVE-2019-1003040 State: PUBLISHED Published: 2019-03-28T17:59:29 Last Updated: 2024-08-05T03:07:16.744Z Vendors: Jenkins project Products: Jenkins Script Security Plugin Description: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/03/28/2 - http://www.securityfocus.com/bid/107628 - https://access.redhat.com/errata/RHSA-2019:1423 - https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1353
CVE ID: CVE-2019-1003041 State: PUBLISHED Published: 2019-03-28T17:59:29 Last Updated: 2024-08-05T03:07:17.842Z Vendors: Jenkins project Products: Jenkins Pipeline: Groovy Plugin Description: A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/03/28/2 - http://www.securityfocus.com/bid/107628 - https://access.redhat.com/errata/RHSA-2019:1423 - https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1353
CVE ID: CVE-2019-1003042 State: PUBLISHED Published: 2019-03-28T17:59:29 Last Updated: 2024-08-05T03:07:16.802Z Vendors: Jenkins project Products: Jenkins Lockable Resources Plugin Description: A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/03/28/2 - http://www.securityfocus.com/bid/107628 - https://access.redhat.com/errata/RHSA-2019:1423 - https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361
CVE ID: CVE-2019-1003043 State: PUBLISHED Published: 2019-03-28T17:59:29 Last Updated: 2024-08-05T03:07:18.034Z Vendors: Jenkins project Products: Jenkins Slack Notification Plugin Description: A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/03/28/2 - http://www.securityfocus.com/bid/107628 - https://jenkins.io/security/advisory/2019-03-25/#SECURITY-9
ity/2019/03/28/2 - http://www.securityfocus.com/bid/107628 - https://jenkins.io/security/advisory/2019-03-25/#SECURITY-976
CVE ID: CVE-2019-1003044 State: PUBLISHED Published: 2019-03-28T17:59:29 Last Updated: 2024-08-05T03:07:17.889Z Vendors: Jenkins project Products: Jenkins Slack Notification Plugin Description: A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/03/28/2 - http://www.securityfocus.com/bid/107628 - https://jenkins.io/security/advisory/2019-03-25/#SECURITY-976
CVE ID: CVE-2019-1003045 State: PUBLISHED Published: 2019-03-28T17:59:29 Last Updated: 2024-08-05T03:07:16.801Z Vendors: Jenkins project Products: Jenkins ECS Publisher Plugin Description: A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenkins home directory to obtain the API token configured in this plugin's configuration. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/03/28/2 - http://www.securityfocus.com/bid/107628 - https://jenkins.io/security/advisory/2019-03-25/#SECURITY-846
CVE ID: CVE-2019-1003046 State: PUBLISHED Published: 2019-03-28T17:59:29 Last Updated: 2024-08-05T03:07:16.810Z Vendors: Jenkins project Products: Jenkins Fortify on Demand Uploader Plugin Description: A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an attacker-specified server. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/03/28/2 - http://www.securityfocus.com/bid/107628 - https://jenkins.io/security/advisory/2019-03-25/#SECURITY-992
CVE ID: CVE-2019-1003047 State: PUBLISHED Published: 2019-03-28T17:59:29 Last Updated: 2024-08-05T03:07:17.963Z Vendors: Jenkins project Products: Jenkins Fortify on Demand Uploader Plugin Description: A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/03/28/2 - http://www.securityfocus.com/bid/107628 - https://jenkins.io/security/advisory/2019-03-25/#SECURITY-992
CVE ID: CVE-2019-1003048 State: PUBLISHED Published: 2019-03-28T17:59:30 Last Updated: 2024-08-05T03:07:16.841Z Vendors: Jenkins project Products: Jenkins PRQA Plugin Description: A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtain the unencrypted password from the plugin configuration. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/03/28/2 - http://www.securityfocus.com/bid/107628 - https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1089
CVE ID: CVE-2019-1003049 State: PUBLISHED Published: 2019-04-10T20:12:29 Last Updated: 2024-08-05T03:07:18.205Z Vendors: Jenkins project Products: Jenkins Description: Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107901 - https://access.redhat.com/errata/RHBA-2019:1605 - https://www.oracle.com/security-alerts/cpuapr2022.
us.com/bid/107901 - https://access.redhat.com/errata/RHBA-2019:1605 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289
CVE ID: CVE-2019-1003050 State: PUBLISHED Published: 2019-04-10T20:12:30 Last Updated: 2024-08-05T03:07:17.918Z Vendors: Jenkins project Products: Jenkins Description: The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107889 - https://access.redhat.com/errata/RHBA-2019:1605 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://jenkins.io/security/advisory/2019-04-10/#S
-2019:1605 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1327
CVE ID: CVE-2019-1003051 State: PUBLISHED Published: 2019-04-04T15:38:47 Last Updated: 2024-08-05T03:07:17.934Z Vendors: Jenkins project Products: Jenkins IRC Plugin Description: Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-829
CVE ID: CVE-2019-1003052 State: PUBLISHED Published: 2019-04-04T15:38:47 Last Updated: 2024-08-05T03:07:17.683Z Vendors: Jenkins project Products: Jenkins AWS Elastic Beanstalk Publisher Plugin Description: Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-831
CVE ID: CVE-2019-1003053 State: PUBLISHED Published: 2019-04-04T15:38:47 Last Updated: 2024-08-05T03:07:17.840Z Vendors: Jenkins project Products: Jenkins HockeyApp Plugin Description: Jenkins HockeyApp Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-839
CVE ID: CVE-2019-1003054 State: PUBLISHED Published: 2019-04-04T15:38:47 Last Updated: 2024-08-05T03:07:17.915Z Vendors: Jenkins project Products: Jenkins Jira Issue Updater Plugin Description: Jenkins Jira Issue Updater Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-837
CVE ID: CVE-2019-1003055 State: PUBLISHED Published: 2019-04-04T15:38:47 Last Updated: 2024-08-05T03:07:17.822Z Vendors: Jenkins project Products: Jenkins FTP publisher Plugin Description: Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-954
CVE ID: CVE-2019-1003056 State: PUBLISHED Published: 2019-04-04T15:38:48 Last Updated: 2024-08-05T03:07:17.883Z Vendors: Jenkins project Products: Jenkins WebSphere Deployer Plugin Description: Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-956
CVE ID: CVE-2019-1003057 State: PUBLISHED Published: 2019-04-04T15:38:48 Last Updated: 2024-08-05T03:07:17.893Z Vendors: Jenkins project Products: Jenkins Bitbucket Approve Plugin Description: Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-965
CVE ID: CVE-2019-1003058 State: PUBLISHED Published: 2019-04-04T15:38:48 Last Updated: 2024-08-05T03:07:17.962Z Vendors: Jenkins project Products: Jenkins FTP publisher Plugin Description: A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers to initiate a connection to an attacker-specified server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-974
CVE ID: CVE-2019-1003059 State: PUBLISHED Published: 2019-04-04T15:38:48 Last Updated: 2024-08-05T03:07:17.887Z Vendors: Jenkins project Products: Jenkins FTP publisher Plugin Description: A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-974
CVE ID: CVE-2019-1003060 State: PUBLISHED Published: 2019-04-04T15:38:48 Last Updated: 2024-08-05T03:07:17.872Z Vendors: Jenkins project Products: Jenkins Official OWASP ZAP Plugin Description: Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1041
CVE ID: CVE-2019-1003061 State: PUBLISHED Published: 2019-04-04T15:38:48 Last Updated: 2024-08-05T03:07:17.907Z Vendors: Jenkins project Products: Jenkins jenkins-cloudformation-plugin Plugin Description: Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107790 - http://www.openwall.com/lists/oss-security/2019/04/12/2 - https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1042