Vulnerabilities > Jenkins > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-09-25 | CVE-2019-10420 | Insufficiently Protected Credentials vulnerability in Jenkins Assembla Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. | 5.5 |
| 2019-09-25 | CVE-2019-10419 | Insufficiently Protected Credentials vulnerability in Jenkins Vfabric Application Director 1.2/1.3 Jenkins vFabric Application Director Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. | 5.5 |
| 2019-09-25 | CVE-2019-10416 | Insufficiently Protected Credentials vulnerability in Jenkins Violation Comments to Gitlab Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system. | 6.5 |
| 2019-09-25 | CVE-2019-10415 | Insufficiently Protected Credentials vulnerability in Jenkins Violation Comments to Gitlab Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system. | 6.5 |
| 2019-09-25 | CVE-2019-10414 | Insufficiently Protected Credentials vulnerability in Jenkins GIT Changelog Jenkins Git Changelog Plugin 2.17 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system. | 6.5 |
| 2019-09-25 | CVE-2019-10413 | Insufficiently Protected Credentials vulnerability in Jenkins Data Theorem Mobile APP Security Jenkins Data Theorem: CI/CD Plugin 1.3 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system. | 6.5 |
| 2019-09-25 | CVE-2019-10410 | Cross-site Scripting vulnerability in Jenkins LOG Parser Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by users able to define log parsing rules. | 5.4 |
| 2019-09-25 | CVE-2019-10409 | Missing Authorization vulnerability in Jenkins Project Inheritance A missing permission check in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers with Overall/Read permission to trigger project generation from templates. | 4.3 |
| 2019-09-25 | CVE-2019-10408 | Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Project Inheritance A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project generation from templates. | 4.3 |
| 2019-09-25 | CVE-2019-10407 | Information Exposure vulnerability in Jenkins Project Inheritance Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin. | 6.5 |