Total
502 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-1003088 | 1 Jenkins | 1 Fabric Beta Publisher | 2024-11-21 | 4.0 MEDIUM | 6.5 MEDIUM |
|
Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
|
|||||
| CVE-2019-1003075 | 1 Jenkins | 1 Audit To Database | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003074 | 1 Jenkins | 1 Hyper.sh Commons | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins Hyper.sh Commons Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003073 | 1 Jenkins | 1 Vs Team Services Continuous Deployment | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
|
|||||
| CVE-2019-1003072 | 1 Jenkins | 1 Wildfly Deployer | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins WildFly Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
|
|||||
| CVE-2019-1003071 | 1 Jenkins | 1 Octopusdeploy | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins OctopusDeploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003070 | 1 Jenkins | 1 Veracode-scanner | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003069 | 1 Jenkins | 1 Aqua Security Scanner | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003068 | 1 Jenkins | 1 Vmware Vrealize Automation | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
|
|||||
| CVE-2019-1003067 | 1 Jenkins | 1 Trac Publisher | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
|
|||||
| CVE-2019-1003066 | 1 Jenkins | 1 Bugzilla | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins Bugzilla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003065 | 1 Jenkins | 1 Cloudshare Docker-machine | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003064 | 1 Jenkins | 1 Aws-device-farm | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003063 | 1 Jenkins | 1 Amazon Sns Build Notifier | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003062 | 1 Jenkins | 1 Aws Cloudwatch Logs Publisher | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003061 | 1 Jenkins | 1 Jenkins-cloudformation-plugin | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
|
|||||
| CVE-2019-1003060 | 1 Jenkins | 1 Official Owasp Zap | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003057 | 1 Jenkins | 1 Bitbucket Approve | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003056 | 1 Jenkins | 1 Websphere Deployer | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
|
|||||
| CVE-2019-1003055 | 1 Jenkins | 1 Ftp Publisher | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003054 | 1 Jenkins | 1 Jira Issue Updater | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins Jira Issue Updater Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
|
|||||
| CVE-2019-1003053 | 1 Jenkins | 1 Hockeyapp | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins HockeyApp Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
|
|||||
| CVE-2019-1003052 | 1 Jenkins | 1 Aws Elastic Beanstalk Publisher | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003051 | 1 Jenkins | 1 Irc | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
|
|||||
| CVE-2019-1003048 | 1 Jenkins | 1 Prqa | 2024-11-21 | 2.1 LOW | 7.8 HIGH |
|
A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtain the unencrypted password from the plugin configuration.
|
|||||
| CVE-2019-0307 | 1 Sap | 1 Solution Manager | 2024-11-21 | 2.7 LOW | 2.4 LOW |
|
Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges could gain access to the entire configuration, but no system sensitive information can be gained.
|
|||||
| CVE-2018-8864 | 1 Atisystem | 8 Alert4000, Alert4000 Firmware, Hpss16 and 5 more | 2024-11-21 | 2.9 LOW | 3.1 LOW |
|
In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, a missing encryption of sensitive data vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms.
|
|||||
| CVE-2018-7781 | 1 Schneider-electric | 40 Ibp1110-1er, Ibp1110-1er Firmware, Ibp219-1er and 37 more | 2024-11-21 | 4.0 MEDIUM | 8.8 HIGH |
|
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, by sending a specially crafted request an authenticated user can view password in clear text and results in privilege escalation.
|
|||||
| CVE-2018-7498 | 1 Philips | 2 Alice 6, Alice 6 Firmware | 2024-11-21 | 5.0 MEDIUM | 9.8 CRITICAL |
|
In Philips Alice 6 System version R8.0.2 or prior, the lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys.
|
|||||
| CVE-2018-6976 | 1 Vmware | 1 Workspace One | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
|
The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. This vulnerability relates to unencrypted filenames and associated metadata in SQLite database for the Content Locker.
|
|||||
| CVE-2018-6975 | 1 Vmware | 1 Intelligent Hub | 2024-11-21 | 2.1 LOW | 5.5 MEDIUM |
|
The AirWatch Agent for iOS prior to 5.8.1 contains a data protection vulnerability whereby the files and keychain entries in the Agent are not encrypted.
|
|||||
| CVE-2018-6674 | 2 Mcafee, Microsoft | 2 Virusscan Enterprise, Windows | 2024-11-21 | 2.1 LOW | 6.8 MEDIUM |
|
Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 13 allows local users to spawn unrelated processes with elevated privileges via the system administrator granting McTray.exe elevated privileges (by default it runs with the current user's privileges).
|
|||||
| CVE-2018-5482 | 1 Netapp | 1 Snapcenter Server | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
|
NetApp SnapCenter Server prior to 4.1 does not set the secure flag for a sensitive cookie in an HTTPS session which can allow the transmission of the cookie in plain text over an unencrypted channel.
|
|||||
| CVE-2018-5481 | 1 Netapp | 1 Oncommand Unified Manager | 2024-11-21 | 5.8 MEDIUM | 7.4 HIGH |
|
OnCommand Unified Manager for 7-Mode (core package) prior to 5.2.4 uses cookies that lack the secure attribute in certain circumstances making it vulnerable to impersonation via man-in-the-middle (MITM) attacks.
|
|||||
| CVE-2018-5261 | 1 Flexense | 1 Diskboss | 2024-11-21 | 4.3 MEDIUM | 8.1 HIGH |
|
An issue was discovered in Flexense DiskBoss 8.8.16 and earlier. Due to the usage of plaintext information from the handshake as input for the encryption key used for the encryption of the rest of the session, the server and client disclose sensitive information, such as the authentication credentials, to any man-in-the-middle (MiTM) listener.
|
|||||
| CVE-2018-5185 | 4 Canonical, Debian, Mozilla and 1 more | 10 Ubuntu Linux, Debian Linux, Thunderbird and 7 more | 2024-11-21 | 4.3 MEDIUM | 6.5 MEDIUM |
|
Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.
|
|||||
| CVE-2018-5162 | 4 Canonical, Debian, Mozilla and 1 more | 10 Ubuntu Linux, Debian Linux, Thunderbird and 7 more | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
|
Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.
|
|||||
| CVE-2018-4855 | 1 Siemens | 4 Siclock Tc100, Siclock Tc100 Firmware, Siclock Tc400 and 1 more | 2024-11-21 | 4.3 MEDIUM | 6.5 MEDIUM |
|
A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). Unencrypted storage of passwords in the client configuration files and during network transmission could allow an attacker in a privileged position to obtain access passwords.
|
|||||
| CVE-2018-4847 | 1 Siemens | 1 Simatic Wincc Oa Operator | 2024-11-21 | 2.1 LOW | 4.6 MEDIUM |
|
A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4). Insufficient protection of sensitive information (e.g. session key for accessing server) in Siemens WinCC OA Operator iOS app could allow an attacker with physical access to the mobile device to read unencrypted data from the app's directory. Siemens provides mitigations to resolve the security issue.
|
|||||
| CVE-2018-3826 | 1 Elastic | 1 Elasticsearch | 2024-11-21 | 4.0 MEDIUM | 6.5 MEDIUM |
|
In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using the _snapshot API they can be exposed as plain text by users able to query the _snapshot API.
|
|||||