rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-10272 
An issue was discovered in Weaver e-cology 9.0. There is a CRLF Injection vulnerability via the /workflow/request/ViewRequestForwardSPA.jsp isintervenor parameter, as demonstrated by the %0aSet-cookie: substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T17:47:05.000Z
CVE-2019-10273 
Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-04T15:36:47.000Z
CVE-2019-10276 
Western Bridge Cobub Razor 0.8.0 has a file upload vulnerability via the web/assets/swf/uploadify.php URI, as demonstrated by a .php file with the image/jpeg content type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-29T06:06:31.000Z
CVE-2019-10277 
Jenkins StarTeam Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins StarTeam Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-10278 
A cross-site request forgery vulnerability in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins jenkins-reviewbot Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-10279 
A missing permission check in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins jenkins-reviewbot Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-10280 
Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Assembla Auth Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-10281 
Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Relution Enterprise Appstore Publisher Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-10282 
Jenkins Klaros-Testmanagement Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Klaros-Testmanagement Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-10283 
Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins mabl Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-10284 
Jenkins Diawi Upload Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Diawi Upload Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-10285 
Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Minio Storage Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-10286 
Jenkins DeployHub Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins DeployHub Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-10287 
Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins youtrack-plugin Plugin
Published: 2019-04-04T15:38:50.000Z
CVE-2019-10288 
Jenkins Jabber Server Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Jabber Server Plugin
Published: 2019-04-04T15:38:50.000Z
CVE-2019-10289 
A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method allowed attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Netsparker Cloud Scan Plugin
Published: 2019-04-04T15:38:50.000Z
CVE-2019-10290 
A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method allowed attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Netsparker Cloud Scan Plugin
Published: 2019-04-04T15:38:50.000Z
CVE-2019-10291 
Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Netsparker Cloud Scan Plugin
Published: 2019-04-04T15:38:50.000Z
CVE-2019-10292 
A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Kmap Plugin
Published: 2019-04-04T15:38:50.000Z
CVE-2019-10293 
A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Kmap Plugin
Published: 2019-04-04T15:38:50.000Z
CVE-2019-10294 
Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Kmap Plugin
Published: 2019-04-04T15:38:50.000Z
CVE-2019-10295 
Jenkins crittercism-dsym Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins crittercism-dsym Plugin
Published: 2019-04-04T15:38:50.000Z
CVE-2019-10296 
Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Serena SRA Deploy Plugin
Published: 2019-04-04T15:38:50.000Z
CVE-2019-10297 
Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Sametime Plugin
Published: 2019-04-04T15:38:50.000Z
CVE-2019-10298 
Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Koji Plugin
Published: 2019-04-04T15:38:50.000Z
CVE-2019-10299 
Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins CloudCoreo DeployTime Plugin
Published: 2019-04-04T15:38:50.000Z
CVE-2019-10300 
A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins GitLab Plugin
Published: 2019-04-18T16:54:18.000Z
CVE-2019-10301 
A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins GitLab Plugin
Published: 2019-04-18T16:54:18.000Z
CVE-2019-10302 
Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins jira-ext Plugin
Published: 2019-04-18T16:54:18.000Z
CVE-2019-10303 
Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they could be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Azure PublisherSettings Credentials Plugin
Published: 2019-04-18T16:54:18.000Z
CVE-2019-10304 
A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins XebiaLabs XL Deploy Plugin
Published: 2019-04-18T16:54:18.000Z
CVE-2019-10305 
A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins XebiaLabs XL Deploy Plugin
Published: 2019-04-18T16:54:18.000Z
CVE-2019-10306 
A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execute arbitrary code on the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins ontrack Plugin
Published: 2019-04-18T16:54:18.000Z
CVE-2019-10307 
A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers to change the per-job default graph configuration for all users.
Affected products: vendor: Jenkins project
product: Jenkins Static Analysis Utilities Plugin
Published: 2019-04-30T12:25:17.000Z
CVE-2019-10308 
A missing permission check in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed attackers with Overall/Read permission to change the per-job default graph configuration for all users.
Affected products: vendor: Jenkins project
product: Jenkins Static Analysis Utilities Plugin
Published: 2019-04-30T12:25:17.000Z
CVE-2019-10309 
Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm clients.
Affected products: vendor: Jenkins project
product: Jenkins Self-Organizing Swarm Plug-in Modules Plugin
Published: 2019-04-30T12:25:17.000Z
CVE-2019-10310 
A cross-site request forgery vulnerability in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method allowed attackers permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins
Affected products: vendor: Jenkins project
product: Jenkins Ansible Tower Plugin
Published: 2019-04-30T12:25:17.000Z
CVE-2019-10311 
A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Ansible Tower Plugin
Published: 2019-04-30T12:25:17.000Z
CVE-2019-10312 
A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillTowerCredentialsIdItems method allowed attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Ansible Tower Plugin
Published: 2019-04-30T12:25:17.000Z
CVE-2019-10313 
Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Twitter Plugin
Published: 2019-04-30T12:25:17.000Z
CVE-2019-10314 
Jenkins Koji Plugin disables SSL/TLS and hostname verification globally for the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins Koji Plugin
Published: 2019-04-30T12:25:17.000Z
CVE-2019-10315 
Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.
Affected products: vendor: Jenkins project
product: Jenkins GitHub Authentication Plugin
Published: 2019-04-30T12:25:17.000Z
CVE-2019-10316 
Jenkins Aqua MicroScanner Plugin 1.0.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Aqua MicroScanner Plugin
Published: 2019-04-30T12:25:18.000Z
CVE-2019-10317 
Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins SiteMonitor Plugin
Published: 2019-04-30T12:25:18.000Z
CVE-2019-10318 
Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Azure AD Plugin
Published: 2019-04-30T12:25:18.000Z
CVE-2019-10319 
A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allowed users with Overall/Read permission to obtain limited information about the file /etc/shadow and the user Jenkins is running as.
Affected products: vendor: Jenkins project
product: Jenkins PAM Authentication Plugin
Published: 2019-05-21T13:00:22.000Z
CVE-2019-10320 
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
Affected products: vendor: Jenkins project
product: Jenkins Credentials Plugin
Published: 2019-05-21T13:00:22.000Z
CVE-2019-10321 
A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Artifactory Plugin
Published: 2019-05-31T14:20:19.000Z
CVE-2019-10322 
A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Artifactory Plugin
Published: 2019-05-31T14:20:19.000Z
CVE-2019-10323 
A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Artifactory Plugin
Published: 2019-05-31T14:20:19.000Z
CVE-2019-10324 
A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform release staging for Gradle and Maven projects, and promote previously staged builds, respectively.
Affected products: vendor: Jenkins project
product: Jenkins Artifactory Plugin
Published: 2019-05-31T14:20:19.000Z
CVE-2019-10325 
A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages.
Affected products: vendor: Jenkins project
product: Jenkins Warnings NG Plugin
Published: 2019-05-31T14:20:19.000Z
CVE-2019-10326 
A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds.
Affected products: vendor: Jenkins project
product: Jenkins Warnings NG Plugin
Published: 2019-05-31T14:20:19.000Z
CVE-2019-10327 
An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline Maven Integration Plugin
Published: 2019-05-31T14:20:19.000Z
CVE-2019-10328 
Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline Remote Loader Plugin
Published: 2019-05-31T14:20:19.000Z
CVE-2019-10329 
Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins InfluxDB Plugin
Published: 2019-05-31T14:20:19.000Z
CVE-2019-10330 
Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.
Affected products: vendor: Jenkins project
product: Jenkins Gitea Plugin
Published: 2019-05-31T14:20:19.000Z
CVE-2019-10331 
A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attackers to connect to an attacker-specified URL using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins ElectricFlow Plugin
Published: 2019-06-11T13:15:26.000Z
CVE-2019-10332 
A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins ElectricFlow Plugin
Published: 2019-06-11T13:15:26.000Z
CVE-2019-10333 
Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access to obtain information about the Jenkins ElectricFlow Plugin configuration and configuration of connected ElectricFlow instances.
Affected products: vendor: Jenkins project
product: Jenkins ElectricFlow Plugin
Published: 2019-06-11T13:15:26.000Z
CVE-2019-10334 
Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used to upload files.
Affected products: vendor: Jenkins project
product: Jenkins ElectricFlow Plugin
Published: 2019-06-11T13:15:26.000Z
CVE-2019-10335 
A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jenkins or control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in the plugin-provided output on build status pages.
Affected products: vendor: Jenkins project
product: Jenkins ElectricFlow Plugin
Published: 2019-06-11T13:15:26.000Z
CVE-2019-10336 
A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin.
Affected products: vendor: Jenkins project
product: Jenkins ElectricFlow Plugin
Published: 2019-06-11T13:15:26.000Z
CVE-2019-10337 
An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.
Affected products: vendor: Jenkins project
product: Jenkins Token Macro Plugin
Published: 2019-06-11T13:15:27.000Z
CVE-2019-10338 
A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed attackers to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials.
Affected products: vendor: Jenkins project
product: Jenkins JX Resources Plugin
Published: 2019-06-11T13:15:27.000Z
CVE-2019-10339 
A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read access to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials.
Affected products: vendor: Jenkins project
product: Jenkins JX Resources Plugin
Published: 2019-06-11T13:15:27.000Z