rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-10340 
A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Docker Plugin
Published: 2019-07-11T13:55:17.000Z
CVE-2019-10341 
A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Docker Plugin
Published: 2019-07-11T13:55:17.000Z
CVE-2019-10342 
A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Docker Plugin
Published: 2019-07-11T13:55:17.000Z
CVE-2019-10343 
Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being applied.
Affected products: vendor: Jenkins project
product: Jenkins Configuration as Code Plugin
Published: 2019-07-31T12:45:20.000Z
CVE-2019-10344 
Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins.
Affected products: vendor: Jenkins project
product: Jenkins Configuration as Code Plugin
Published: 2019-07-31T12:45:21.000Z
CVE-2019-10345 
Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export.
Affected products: vendor: Jenkins project
product: Jenkins Configuration as Code Plugin
Published: 2019-07-31T12:45:21.000Z
CVE-2019-10346 
A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin.
Affected products: vendor: Jenkins project
product: Jenkins Embeddable Build Status Plugin
Published: 2019-07-11T13:55:17.000Z
CVE-2019-10347 
Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Mashup Portlets Plugin
Published: 2019-07-11T13:55:17.000Z
CVE-2019-10348 
Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Gogs Plugin
Published: 2019-07-11T13:55:17.000Z
CVE-2019-10349 
A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Dependency Graph Viewer Plugin
Published: 2019-07-11T13:55:17.000Z
CVE-2019-10350 
Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Port Allocator Plugin
Published: 2019-07-11T13:55:17.000Z
CVE-2019-10351 
Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Caliper CI Plugin
Published: 2019-07-11T13:55:17.000Z
CVE-2019-10352 
A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-07-17T15:45:13.000Z
CVE-2019-10353 
CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-07-17T15:45:13.000Z
CVE-2019-10354 
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-07-17T15:45:13.000Z
CVE-2019-10355 
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.
Affected products: vendor: Jenkins project
product: Jenkins Script Security Plugin
Published: 2019-07-31T12:45:21.000Z
CVE-2019-10356 
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts.
Affected products: vendor: Jenkins project
product: Jenkins Script Security Plugin
Published: 2019-07-31T12:45:21.000Z
CVE-2019-10357 
A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Shared Groovy Libraries Plugin
Published: 2019-07-31T12:45:21.000Z
CVE-2019-10358 
Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log.
Affected products: vendor: Jenkins project
product: Jenkins Maven Integration Plugin
Published: 2019-07-31T12:45:21.000Z
CVE-2019-10359 
A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doSubmit method allowed attackers to perform releases with attacker-specified options.
Affected products: vendor: Jenkins project
product: Jenkins Maven Release Plugin
Published: 2019-07-31T12:45:21.000Z
CVE-2019-10360 
A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Maven Release Plugin
Published: 2019-07-31T12:45:21.000Z
CVE-2019-10361 
Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Maven Release Plugin
Published: 2019-07-31T12:45:21.000Z
CVE-2019-10362 
Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with permission to change Jenkins system configuration to obtain the values of environment variables.
Affected products: vendor: Jenkins project
product: Jenkins Configuration as Code Plugin
Published: 2019-07-31T12:45:21.000Z
CVE-2019-10363 
Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form.
Affected products: vendor: Jenkins project
product: Jenkins Configuration as Code Plugin
Published: 2019-07-31T12:45:21.000Z
CVE-2019-10364 
Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log.
Affected products: vendor: Jenkins project
product: Jenkins Amazon EC2 Plugin
Published: 2019-07-31T12:45:21.000Z
CVE-2019-10365 
Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission.
Affected products: vendor: Jenkins project
product: Jenkins Google Kubernetes Engine Plugin
Published: 2019-07-31T12:45:21.000Z
CVE-2019-10366 
Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Skytap Cloud CI Plugin
Published: 2019-07-31T12:45:21.000Z
CVE-2019-10367 
Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be hidden when logging the configuration being applied.
Affected products: vendor: Jenkins project
product: Jenkins Configuration as Code Plugin
Published: 2019-08-07T14:20:23.000Z
CVE-2019-10368 
A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins JClouds Plugin
Published: 2019-08-07T14:20:23.000Z
CVE-2019-10369 
A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins JClouds Plugin
Published: 2019-08-07T14:20:23.000Z
CVE-2019-10370 
Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting in their exposure.
Affected products: vendor: Jenkins project
product: Jenkins Mask Passwords Plugin
Published: 2019-08-07T14:20:23.000Z
CVE-2019-10371 
A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
Affected products: vendor: Jenkins project
product: Jenkins Gitlab Authentication Plugin
Published: 2019-08-07T14:20:24.000Z
CVE-2019-10372 
An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL outside Jenkins after successful login.
Affected products: vendor: Jenkins project
product: Jenkins Gitlab Authentication Plugin
Published: 2019-08-07T14:20:24.000Z
CVE-2019-10373 
A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipeline description to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Build Pipeline Plugin
Published: 2019-08-07T14:20:24.000Z
CVE-2019-10374 
A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatter to insert links with the javascript scheme into the Jenkins UI.
Affected products: vendor: Jenkins project
product: Jenkins PegDown Formatter Plugin
Published: 2019-08-07T14:20:24.000Z
CVE-2019-10375 
An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins to obtain the contents of any file on the Jenkins master.
Affected products: vendor: Jenkins project
product: Jenkins File System SCM Plugin
Published: 2019-08-07T14:20:24.000Z
CVE-2019-10376 
A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
Affected products: vendor: Jenkins project
product: Jenkins Wall Display Plugin
Published: 2019-08-07T14:20:24.000Z
CVE-2019-10377 
A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Avatar Plugin
Published: 2019-08-07T14:20:24.000Z
CVE-2019-10378 
Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins TestLink Plugin
Published: 2019-08-07T14:20:24.000Z
CVE-2019-10379 
Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Google Cloud Messaging Notification Plugin
Published: 2019-08-07T14:20:24.000Z
CVE-2019-10380 
Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.
Affected products: vendor: Jenkins project
product: Jenkins Simple Travis Pipeline Runner Plugin
Published: 2019-08-07T14:20:24.000Z
CVE-2019-10381 
Jenkins Codefresh Integration Plugin 1.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins Codefresh Integration Plugin
Published: 2019-08-07T14:20:24.000Z
CVE-2019-10382 
Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins VMware Lab Manager Slaves Plugin
Published: 2019-08-07T14:20:24.000Z
CVE-2019-10383 
A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-08-28T15:30:16.000Z
CVE-2019-10384 
Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-08-28T15:30:17.000Z
CVE-2019-10385 
Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins eggPlant Plugin
Published: 2019-08-07T14:20:24.000Z
CVE-2019-10386 
A cross-site request forgery vulnerability in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins XL TestView Plugin
Published: 2019-08-07T14:20:24.000Z
CVE-2019-10387 
A missing permission check in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins XL TestView Plugin
Published: 2019-08-07T14:20:25.000Z
CVE-2019-10388 
A cross-site request forgery vulnerability in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Relution Enterprise Appstore Publisher Plugin
Published: 2019-08-07T14:20:25.000Z
CVE-2019-10389 
A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Relution Enterprise Appstore Publisher Plugin
Published: 2019-08-07T14:20:25.000Z
CVE-2019-10390 
A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.4 and earlier allowed attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins Splunk Plugin
Published: 2019-08-28T15:30:17.000Z
CVE-2019-10391 
Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure.
Affected products: vendor: Jenkins project
product: Jenkins IBM Application Security on Cloud Plugin
Published: 2019-08-28T15:30:17.000Z
CVE-2019-10392 
Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.
Affected products: vendor: Jenkins project
product: Jenkins Git Client Plugin
Published: 2019-09-12T13:55:15.000Z
CVE-2019-10393 
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts.
Affected products: vendor: Jenkins project
product: Jenkins Script Security Plugin
Published: 2019-09-12T13:55:15.000Z
CVE-2019-10394 
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions on the left-hand side of assignment expressions allowed attackers to execute arbitrary code in sandboxed scripts.
Affected products: vendor: Jenkins project
product: Jenkins Script Security Plugin
Published: 2019-09-12T13:55:15.000Z
CVE-2019-10395 
Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties.
Affected products: vendor: Jenkins project
product: Jenkins Build Environment Plugin
Published: 2019-09-12T13:55:15.000Z
CVE-2019-10396 
Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions.
Affected products: vendor: Jenkins project
product: Jenkins Dashboard View Plugin
Published: 2019-09-12T13:55:15.000Z
CVE-2019-10397 
Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure.
Affected products: vendor: Jenkins project
product: Jenkins Aqua Security Serverless Scanner Plugin
Published: 2019-09-12T13:55:15.000Z
CVE-2019-10398 
Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Beaker Builder Plugin
Published: 2019-09-12T13:55:15.000Z
CVE-2019-10399 
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in increment and decrement expressions allowed attackers to execute arbitrary code in sandboxed scripts.
Affected products: vendor: Jenkins project
product: Jenkins Script Security Plugin
Published: 2019-09-12T13:55:15.000Z
CVE-2019-10400 
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement expressions not involving actual assignment allowed attackers to execute arbitrary code in sandboxed scripts.
Affected products: vendor: Jenkins project
product: Jenkins Script Security Plugin
Published: 2019-09-12T13:55:15.000Z
CVE-2019-10401 
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents (typically Job/Configure).
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-09-25T15:05:32.000Z
CVE-2019-10402 
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-09-25T15:05:32.000Z
CVE-2019-10403 
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-09-25T15:05:32.000Z
CVE-2019-10404 
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored XSS vulnerability exploitable by users able to control parts of the reason a queue item is blocked, such as label expressions not matching any idle executors.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-09-25T15:05:32.000Z
CVE-2019-10405 
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-09-25T15:05:32.000Z
CVE-2019-10406 
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-09-25T15:05:32.000Z
CVE-2019-10407 
Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin.
Affected products: vendor: Jenkins project
product: Jenkins Project Inheritance Plugin
Published: 2019-09-25T15:05:32.000Z
CVE-2019-10408 
A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project generation from templates.
Affected products: vendor: Jenkins project
product: Jenkins Project Inheritance Plugin
Published: 2019-09-25T15:05:32.000Z