Jenkins
Jenkins Security Advisory 2019-10-01
2019-10-01 Oct 1, 2019 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2019-10-01/. 5 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2019-10-01/
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
5 lines
Showing 1–5 of 5
CVE-2019-10433
BR2019-0000-015623
SECURITY-1423
unclaimed
DingTalk Plugin stores credentials in plain text
Credited as David Fiser of Trend Micro Nebula working with Trend Micro's Zero Day Initiative
CVE-2019-10434
BR2019-0000-015624
SECURITY-1515
unclaimed
LDAP Email Plugin shows plain text password in configuration form
Credited as James Holderness, IB Boost
CVE-2019-10435
BR2019-0000-015625
SECURITY-1524
unclaimed
SourceGear Vault Plugin shows plain text password in configuration form
Credited as James Holderness, IB Boost
CVE-2019-10431
BR2019-0000-015626
SECURITY-1579
unclaimed
Sandbox bypass vulnerability in Script Security Plugin
Credited as Nils Emmerich of ERNW Research GmbH
CVE-2019-10432
BR2019-0000-015627
SECURITY-1590
unclaimed
Stored XSS vulnerability in HTML Publisher Plugin
Credited as Viktor Gazdag NCC Group