deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-j2pc-v64r-mv4f
Package: io.github.ascopes:protobuf-maven-plugin (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-354: Improper Validation of Integrity Check Value, CWE-693: Protection Mechanism Failure
Vulnerable versions: >= 4.0.0, <= 4.0.1
Patched in: 4.0.2

Summary: Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH

Details:
### Summary
The expected `protocDigest` is ignored when protoc is taken from the `PATH`.

### Details
The documentation for the `protocDigest` parameter says:
> ... Users may wish to specify this if using a `PATH`-based binary ...

However, when specifying `<protoc>PATH</protoc>` the `protocDigest` is not actually checked because the code returns here already
https://github.com/ascopes/protobuf-maven-plugin/blob/59097aae8062c461129a13dcda2f4116b90a8765/protobuf-maven-plugin/src/main/java/io/github/ascopes/protobufmavenplugin/protoc/ProtocResolver.java#L91-L93

before the digest check:
https://github.com/ascopes/protobuf-maven-plugin/blob/59097aae8062c461129a13dcda2f4116b90a8765/protobuf-maven-plugin/src/main/java/io/github/ascopes/protobufmavenplugin/protoc/ProtocResolver.java#L106

### PoC
Specify:
```xml
<protoc>PATH</protoc>
<protocDigest>sha256:[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0000</protocDigest>
```

And notice how the `protoc` on the `PATH` is not rejected, despite a digest mismatch.

### Impact
Users who have an untrusted `protoc` executable on their `PATH` and rely `<protocDigest>` as protection are affected.
GitHub Security Advisory: GHSA-c32m-27pj-4xcj
Package: org.xwiki.platform:xwiki-platform-security-requiredrights-default (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-357: Insufficient UI Warning of Dangerous Operations
Vulnerable versions: >= 16.5.0-rc-1, < 16.10.3
Patched in: 16.10.3

Summary: XWiki's required right warnings for macros are incomplete

Details:
### Impact
When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns about the execution of these macros since XWiki 15.9RC1. These required rights analyzers that trigger these warnings are incomplete, allowing an attacker to hide malicious content. For most macros, the existing analyzers don't consider non-lowercase parameters. Further, most macro parameters that can contain XWiki syntax like titles of information boxes weren't analyzed at all. Similarly, the "source" parameters of the content and context macro weren't anylzed even though they could contain arbitrary XWiki syntax. In the worst case, this could allow a malicious to add malicious script macros including Groovy or Python macros to a page that are then executed after another user with programming righs edits the page, thus allowing remote code execution.

### Patches
The required rights analyzers have been made more robust and extended to cover those cases in XWiki 16.4.7, 16.10.3 and 17.0.0.

### Workarounds
We're not aware of any workarounds except for being careful when editing content authored by untrusted users.

### References
* https://jira.xwiki.org/browse/XWIKI-22763
* https://jira.xwiki.org/browse/XWIKI-22759
* https://jira.xwiki.org/browse/XWIKI-22758
* https://jira.xwiki.org/browse/XWIKI-22799
* https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8
* https://github.com/xwiki/xwiki-platform/commit/cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7
* https://github.com/xwiki/xwiki-platform/commit/0a705e8e253cb871b804e25c53b2bde879c886bd
* https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c
GitHub Security Advisory: GHSA-xf7m-v66q-76w8
Package: com.liferay:com.liferay.blogs.item.selector.web (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 6.0.19
Patched in: 6.0.19

Summary: Liferay Portal and DXP do not check permissions of images in a blog entry

Details:
Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.
GitHub Security Advisory: GHSA-6533-fhr2-f38h
Package: com.liferay.portal:com.liferay.portal.impl (MAVEN)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-525: Use of Web Browser Cache Containing Sensitive Information
Vulnerable versions: < 69.1.0
Patched in: 69.1.0

Summary: Liferay Portal and DXP use an incorrect cache-control header

Details:
The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache.
GitHub Security Advisory: GHSA-6533-fhr2-f38h
Package: com.liferay:com.liferay.adaptive.media.web (MAVEN)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-525: Use of Web Browser Cache Containing Sensitive Information
Vulnerable versions: < 5.0.52
Patched in: 5.0.52

Summary: Liferay Portal and DXP use an incorrect cache-control header

Details:
The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache.
GitHub Security Advisory: GHSA-q285-wfpg-93hr
Package: com.liferay:com.liferay.dynamic.data.mapping.item.selector.web (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.0.9
Patched in: 1.0.9

Summary: Liferay Portal and DXP affected by multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page

Details:
Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 35 through update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle Name, or (3) Last Name text field.
GitHub Security Advisory: GHSA-2j97-4jmq-c4xf
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.3.8, < 7.4.3.112-ga112
Patched in: 7.4.3.112-ga112

Summary: Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter

Details:
Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId` parameter.
GitHub Security Advisory: GHSA-25qh-j22f-pwp8
Package: ch.qos.logback:logback-core (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 1.3.16
Patched in: 1.3.16

Summary: QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing

Details:
QOS.CH logback-core versions up to 1.5.18 contain an ACE vulnerability in conditional configuration file processing in Java applications. This vulnerability allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting a malicious environment variable before program execution.

A successful attack requires the Janino library and Spring Framework to be present on the user's class path. Additionally, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privileges.
GitHub Security Advisory: GHSA-25qh-j22f-pwp8
Package: ch.qos.logback:logback-core (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 1.4.0, < 1.5.19
Patched in: 1.5.19

Summary: QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing

Details:
QOS.CH logback-core versions up to 1.5.18 contain an ACE vulnerability in conditional configuration file processing in Java applications. This vulnerability allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting a malicious environment variable before program execution.

A successful attack requires the Janino library and Spring Framework to be present on the user's class path. Additionally, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privileges.
GitHub Security Advisory: GHSA-56jv-4ww3-65mw
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0-ga1, < 7.4.3.112-ga112
Patched in: 7.4.3.112-ga112

Summary: Liferay Portal is vulnerable to XSS in the Blogs widget

Details:
Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> injected into a blog entry's “Content” text field.

The Blogs widget in Liferay DXP does not add the sandbox attribute to <iframe> elements, which allows remote attackers to access the parent page via scripts and links in the frame page.
GitHub Security Advisory: GHSA-f5vh-4rj2-w8r8
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 7.4.0-ga1, < 7.4.3.110
Patched in: 7.4.3.110

Summary: Liferay Portal is vulnerable to DNS rebinding attacks

Details:
By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain.
GitHub Security Advisory: GHSA-8hw3-ghwv-crfh
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: >= 7.4.0-ga1, < 7.4.3.120
Patched in: 7.4.3.120

Summary: Liferay Portal vulnerable to password enumeration

Details:
Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack.
GitHub Security Advisory: GHSA-95h4-w6j8-2rp8
Package: io.undertow:undertow-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-404: Improper Resource Shutdown or Release, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 2.3.0.Alpha1, < 2.3.20.Final
Patched in: 2.3.20.Final

Summary: Undertow MadeYouReset HTTP/2 DDoS Vulnerability

Details:
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
GitHub Security Advisory: GHSA-95h4-w6j8-2rp8
Package: io.undertow:undertow-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-404: Improper Resource Shutdown or Release, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2.2.38.Final
Patched in: 2.2.38.Final

Summary: Undertow MadeYouReset HTTP/2 DDoS Vulnerability

Details:
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
GitHub Security Advisory: GHSA-wpr5-rc2j-99p2
Package: org.jenkins-ci.plugins:publish-to-bitbucket (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 0.4
Patched in: unpatched

Summary: Jenkins Publish to Bitbucket Plugin is missing a permissions check

Details:
Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-m244-6mff-p355
Package: org.jenkins-ci.plugins:publish-to-bitbucket (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: <= 0.4
Patched in: unpatched

Summary: Jenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check

Details:
Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-v549-7pm5-f8qr
Package: org.jenkins-ci.plugins:publish-to-bitbucket (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 0.4
Patched in: unpatched

Summary: Jenkins Publish to Bitbucket Plugin is missing a permissions check

Details:
Jenkins Publish to Bitbucket Plugin 0.4 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-hv42-crpx-q355
Package: org.jenkins-ci.plugins:curseforge-publisher (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-311: Missing Encryption of Sensitive Data
Vulnerable versions: <= 1.0
Patched in: unpatched

Summary: Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form

Details:
Jenkins Curseforge Publisher Plugin 1.0 and earlier stores API Keys unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

These keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Additionally, the job configuration form does not mask these keys, increasing the potential for attackers to observe and capture them.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-h83r-7f9f-mqjj
Package: org.jenkins-ci.plugins:nexus-task-runner (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 0.9.2
Patched in: unpatched

Summary: Jenkins Nexus Task Runner Plugin is missing a permission check

Details:
Jenkins Nexus Task Runner Plugin 0.9.2 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-x2pv-fph3-phfx
Package: org.jenkins-ci.plugins:nexus-task-runner (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: <= 0.9.2
Patched in: unpatched

Summary: Jenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery

Details:
Jenkins Nexus Task Runner Plugin 0.9.2 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-jwm4-955w-4hj3
Package: org.jenkins-ci.plugins:themis (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 1.4.1
Patched in: unpatched

Summary: Jenkins Themis Plugin is missing a permission check

Details:
Jenkins Themis Plugin 1.4.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-mj6v-4wr4-gj57
Package: org.jenkins-ci.plugins:windocks-start-container (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 1.4
Patched in: unpatched

Summary: Jenkins Start Windocks Containers Plugin is missing a permission check

Details:
Jenkins Start Windocks Containers Plugin 1.4 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-jfg6-4gx3-3v7w
Package: org.jenkins-ci.plugins:jdepend (MAVEN)
Severity: HIGH (CVSS 7.1)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: <= 1.3.1
Patched in: unpatched

Summary: Jenkins JDepend Plugin vulnerable to XML external entity attacks

Details:
Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to configure input files for the "Report JDepend" step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-j7r7-7qmf-xq87
Package: org.jenkins-ci.plugins:saml (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-294: Authentication Bypass by Capture-replay
Vulnerable versions: < 4.583.585.v22ccc1139f55
Patched in: 4.583.585.v22ccc1139f55

Summary: Jenkins SAML Plugin does not implement a replay cache

Details:
Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache.

This allows attackers able to obtain information about the SAML authentication flow between a user’s web browser and Jenkins to replay those requests, authenticating to Jenkins as that user.

SAML Plugin 4.583.585.v22ccc1139f55 implements a replay cache that rejects replayed requests.
GitHub Security Advisory: GHSA-rh72-238f-g26q
Package: org.jenkins-ci.plugins:azure-cli (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 0.9
Patched in: unpatched

Summary: Jenkins Azure CLI Plugin does not restrict the commands it executes

Details:
Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller.

This allows attackers with Item/Configure permission to execute arbitrary shell commands on the Jenkins controller.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-4653-9q2r-684q
Package: com.openshift.jenkins:openshift-pipeline (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-311: Missing Encryption of Sensitive Data
Vulnerable versions: <= 1.0.57
Patched in: unpatched

Summary: Jenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job config.xml files

Details:
Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

These token can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-2vmr-8c82-x8xq
Package: io.jenkins.plugins:byteguard-build-actions (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-311: Missing Encryption of Sensitive Data
Vulnerable versions: <= 1.0
Patched in: unpatched

Summary: Jenkins ByteGuard Build Actions Plugin stores API tokens unencrypted in job config.xml files

Details:
Jenkins ByteGuard Build Actions Plugin 1.0 and earlier stores API tokens unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Additionally, the job configuration form does not mask these credentials, increasing the potential for attackers to observe and capture them.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-vmm2-53rc-43v3
Package: io.jenkins.plugins:byteguard-build-actions (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-311: Missing Encryption of Sensitive Data
Vulnerable versions: <= 1.0
Patched in: unpatched

Summary: Jenkins ByteGuard Build Actions Plugin does not mask API tokens displayed on the job configuration form

Details:
Jenkins ByteGuard Build Actions Plugin 1.0 and earlier stores API tokens unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Additionally, the job configuration form does not mask these credentials, increasing the potential for attackers to observe and capture them.

As of publication of this advisory, there is no fix.