Open Source Vulnerabilities

github.com/docker/distribution

Docker Registry has Allocation of Resources Without Limits or Throttling

org.jenkins-ci.plugins:token-macro

Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS

org.jenkins-ci.plugins:cloudfoundry

Jenkins Cloud Foundry Plugin vulnerable to exposure of sensitive information

org.jenkins-ci.plugins:script-security

Jenkins Script Security Plugin sandbox bypass vulnerability

org.jenkins-ci.plugins:groovy

Jenkins Groovy Plugin sandbox bypass vulnerability

org.jenkins-ci.plugins.workflow:workflow-cps-parent, org.jenkins-ci.plugins:pipeline-model-definition, org.jenkins-ci.plugins:script-security

Jenkins Groovy Plugin sandbox bypass vulnerability

org.jenkinsci.plugins:pipeline-model-definition

Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability

org.jenkins-ci.plugins:script-security

Protection Mechanism Failure in Jenkins Script Security Plugin

com.programmingresearch:prqa-plugin

Jenkins PRQA Plugin stored password in plain text

org.jenkins-ci.plugins:script-security

Sandbox bypass vulnerability in Jenkins Script Security Plugin

org.jenkins-ci.plugins:appdynamics-dashboard

Jenkins AppDynamics Dashboard Plugin has insufficiently protected credentials

org.jenkins-ci.plugins.workflow:workflow-cps

Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin

org.jenkins-ci.plugins:slack

Jenkins Slack Notification Plugin missing permission check

de.eacg:ecs-publisher

ECS Publisher Plugin stored and displayed API token in plain text

org.jenkins-ci.plugins:fortify-on-demand-uploader

SSRF vulnerability due to missing permission check in Fortify on Demand Uploader Plugin

org.jenkins-ci.plugins:azure-vm-agents

Missing permission check in Azure VM Agents Plugin allowed modifying VM configuration

org.jenkins-ci.plugins:azure-vm-agents

Information disclosure in Azure VM Agents Plugin

org.jenkins-ci.plugins:job-dsl

Script security sandbox bypass in Jenkins Job DSL Plugin

org.jenkins-ci.plugins:repository-connector

Jenkins Repository Connector Plugin has insufficiently protected credentials

org.jenkins-ci.plugins:matrix-project

Script security sandbox bypass in Matrix Project Plugin

org.jenkins-ci.plugins:azure-vm-agents

Unprivileged users with Overall/Read access are able to enumerate credential IDs in Azure VM Agents Plugin

org.jenkins-ci.plugins:youtrack-plugin

Jenkins youtrack-plugin Plugin stored credentials in plain text

de.e-nexus:jabber-server-plugin

Jenkins Jabber Server Plugin stores credentials in plain text

org.jenkins-ci.plugins:groovy

Jenkins Groovy Plugin sandbox bypass vulnerability

org.jenkins-ci.plugins:email-ext

Script security sandbox bypass in Jenkins Email Extension Plugin

com.openmake:deployhub

Jenkins DeployHub Plugin stores credentials in plain text

com.mabl.integration.jenkins:mabl-integration

Jenkins mabl Plugin stores credentials in plain text

org.jenkins-ci.plugins:diawi-upload

Jenkins Diawi Upload Plugin stores credentials in plain text

org.jenkins-ci.plugins:kmap-jenkins

Missing permission check in Jenkins Kmap Plugin allow SSRF

org.jenkins-ci.plugins:jenkins-reviewbot

Missing permission check in Jenkins jenkins-reviewbot Plugin

org.jenkins-ci.plugins:minio-storage

Jenkins Minio Storage Plugin stores credentials in plain text

com.cloudcoreo.plugins:cloudcoreo-deploytime

Jenkins CloudCoreo DeployTime Plugin stores credentials in plain text

org.jenkins-ci.plugins:sametime

Jenkins Sametime Plugin stores credentials in plain text

org.jenkins-ci.plugins:netsparker-cloud-scan

Jenkins Netsparker Enterprise Scan Plugin stored credentials in plain text

org.jenkins-ci.plugins:koji

Jenkins Koji Plugin stores credentials in plain text

org.jenkins-ci.plugins:kmap-jenkins

Jenkins Kmap Plugin stores credentials in plain text

org.jenkins-ci.plugins:relution-publisher

Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials in plain text

hudson.plugins.klaros:klaros-testmanagement

Jenkins Klaros-Testmanagement Plugin stores credentials in plain text

hudson.plugins:starteam

Jenkins StarTeam Plugin stores credentials in plain text

org.jenkins-ci.plugins:crittercism-dsym

Jenkins crittercism-dsym Plugin stores API key in plain text

com.urbancode.ds.jenkins.plugins:sra-deploy

Jenkins Serena SRA Deploy Plugin stores credentials in plain text

org.jenkins-ci.plugins:netsparker-cloud-scan

Missing permission check in Jenkins Netsparker Cloud Scan Plugin

org.jenkins-ci.plugins:assembla-auth

Jenkins Assembla Auth Plugin stores credentials in plain text

org.apache.tomcat:tomcat-coyote, org.apache.tomcat:tomcat-coyote, org.apache.tomcat:tomcat-coyote, org.apache.tomcat:tomcat-coyote, org.apache.tomcat:tomcat-coyote

Improper Input Validation in Apache Tomcat

org.apache.tomcat:tomcat-catalina-jmx-remote, org.apache.tomcat:tomcat-catalina-jmx-remote, org.apache.tomcat:tomcat-catalina-jmx-remote, org.apache.tomcat:tomcat-catalina-jmx-remote, org.apache.tomcat:tomcat-catalina-jmx-remote, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-catalina

Apache Tomcat Improper Access Control vulnerability

org.jboss.eap:wildfly-undertow

Improper Neutralization of CRLF Sequences in HTTP Headers in Undertow

moodle/moodle, moodle/moodle, moodle/moodle

Moodle Users could elevate their role when accessing the LTI tool on a provider site

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle XSS Vulnerability

org.jenkins-ci.plugins.workflow:workflow-cps

Sandbox bypass in Jenkins Pipeline: Groovy Plugin