Open Source Vulnerabilities

org.jenkins-ci.plugins:bitbucket-approve

Jenkins Bitbucket Approve Plugin stores credentials in plain text

org.jenkins-ci.plugins:zap

Jenkins OWASP ZAP Plugin stores unencrypted credentials

org.jvnet.hudson.plugins:ftppublisher

Missing permission check in Jenkins FTP publisher Plugin

org.jenkins-ci.plugins:websphere-deployer

Jenkins WebSphere Deployer Plugin stores credentials in plain text

org.jenkins-ci.plugins:snsnotify

Jenkins Amazon SNS Build Notifier Plugin stores credentials in plain text

org.jenkins-ci.plugins:aqua-security-scanner

Jenkins Aqua Security Scanner Plugin stores credentials in plain text

org.jenkins-ci.plugins:veracode-scanner

Jenkins veracode-scanner Plugin stores credentials in plain text

org.jenkins-ci.plugins:trac-publisher-plugin

Jenkins Trac Publisher Plugin stores credentials in plain text

com.inkysea.vmware.vra:vmware-vrealize-automation-plugin

Jenkins VMware vRealize Automation Plugin Missing Encryption of Sensitive Data

org.jvnet.hudson.plugins:ftppublisher

Jenkins FTP publisher Plugin stores credentials in plain text

info.bluefloyd.jenkins:jenkins-jira-issue-updater

Jenkins Jira Issue Updater Plugin stores credentials in plain text

org.jenkins-ci.plugins:aws-device-farm

Jenkins aws-device-farm Plugin stores credentials in plain text

org.jenkins-ci.plugins:jenkins-cloudformation-plugin

Jenkins CloudFormation Plugin stores credentials in plain text

org.jenkins-ci.plugins:aws-cloudwatch-logs-publisher

Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials in plain text

org.jvnet.hudson.plugins:bugzilla

Jenkins Bugzilla Plugin stores credentials in plain text

org.jenkins-ci.plugins:cloudshare-docker

Jenkins CloudShare Docker-Machine Plugin stores credentials in plain text

org.jenkins-ci.plugins:vsts-cd

Jenkins VS Team Services Continuous Deployment Plugin stores credentials in plain text

org.jenkins-ci.plugins:audit2db

Missing permission check in Jenkins Audit to Database Plugin

sh.hyper.plugins:hyper-commons

Jenkins hyper.sh Commons Plugin stores credentials in plain text

org.jenkins-ci.plugins:wildfly-deployer

Jenkins wildFly Deployer Plugin stores credentials in plain text

org.jenkins-ci.plugins:perfectomobile

Jenkins Perfecto Mobile Plugin stores credentials in plain text

org.jenkins-ci.plugins:open-stf

Jenkins Open STF Plugin stores credentials in plain text

hudson.plugins.octopusdeploy:octopusdeploy

Jenkins Octopus Deploy Plugin stores credentials in plain text

egor-n:fabric-beta-publisher

Jenkins Fabric-beta-publisher Plugin stores credentials in plain text

org.jenkins-ci.plugins:audit2db

Jenkins Audit to Database Plugin stores credentials in plain text

ren.helloworld:upload-pgyer

Jenkins Upload to pgyer Plugin stores credentials in plain text

node-jose

Cisco node-jose improper validation of JWT signature

org.jenkins-ci.main:jenkins-core

Incorrect Authorization in Jenkins Core

smalruby-editor, smalruby

smalruby and smalruby-editor vulnerable to OS Command Injection

mantisbt/mantisbt, mantisbt/mantisbt, mantisbt/mantisbt

MantisBT allows arbitrary password reset

org.apache.struts:struts2-core, org.apache.struts.xwork:xwork-core

Code injection in Apache Struts

github.com/docker/distribution

Docker Registry has Allocation of Resources Without Limits or Throttling

org.jenkins-ci.plugins:token-macro

Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS

org.jenkins-ci.plugins:cloudfoundry

Jenkins Cloud Foundry Plugin vulnerable to exposure of sensitive information

org.jenkins-ci.plugins:script-security

Jenkins Script Security Plugin sandbox bypass vulnerability

org.jenkins-ci.plugins:groovy

Jenkins Groovy Plugin sandbox bypass vulnerability

org.jenkins-ci.plugins.workflow:workflow-cps-parent, org.jenkins-ci.plugins:pipeline-model-definition, org.jenkins-ci.plugins:script-security

Jenkins Groovy Plugin sandbox bypass vulnerability

org.jenkinsci.plugins:pipeline-model-definition

Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability

org.jenkins-ci.plugins:script-security

Protection Mechanism Failure in Jenkins Script Security Plugin

com.programmingresearch:prqa-plugin

Jenkins PRQA Plugin stored password in plain text

org.jenkins-ci.plugins:script-security

Sandbox bypass vulnerability in Jenkins Script Security Plugin

org.jenkins-ci.plugins:appdynamics-dashboard

Jenkins AppDynamics Dashboard Plugin has insufficiently protected credentials

org.jenkins-ci.plugins.workflow:workflow-cps

Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin

org.jenkins-ci.plugins:slack

Jenkins Slack Notification Plugin missing permission check

de.eacg:ecs-publisher

ECS Publisher Plugin stored and displayed API token in plain text

org.jenkins-ci.plugins:fortify-on-demand-uploader

SSRF vulnerability due to missing permission check in Fortify on Demand Uploader Plugin

org.jenkins-ci.plugins:azure-vm-agents

Missing permission check in Azure VM Agents Plugin allowed modifying VM configuration

org.jenkins-ci.plugins:azure-vm-agents

Information disclosure in Azure VM Agents Plugin

org.jenkins-ci.plugins:job-dsl

Script security sandbox bypass in Jenkins Job DSL Plugin