jenkins credentials binding vulnerabilities and exploits

(subscribe to this query)

4

CVSSv2

Jenkins Credentials Binding Plugin 1.27 and previous versions does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip fi...

Jenkins Credentials Binding

4

CVSSv2

Jenkins Credentials Binding Plugin 1.22 and previous versions does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps.

Jenkins Credentials Binding

4

CVSSv2

Jenkins Credentials Binding Plugin 1.22 and previous versions does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances.

Jenkins Credentials Binding

4

CVSSv2

Jenkins Credentials Binding Plugin 1.14 and previous versions masks passwords it provides to build processes in their build logs. Jenkins however transforms provided password values, e.g. replacing environment variable references, which could result in values different from but s...

Jenkins Credentials Binding

4

CVSSv2

Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line #30 (passwordVariable). The attack vector is: Attacker cre...

Jenkins Credentials Binding 1.17

NA

Jenkins Git Plugin 4.11.4 and previous versions does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.

Jenkins Git

NA

Official Writeup - Simple CTF 2.0 Created: April 23, 2024 7:50 PM Today I completed an other room on TryHackMe with a simple file-upload vulnerability which I built. I have tried for dancing around this whole CTF machine and getting a lot of walls of challenges in the end it co...

1 Github repository

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook