Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-1003083A missing permission check in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers witMaven · org.jenkins-ci.plugins:gearman-plugin · fixed in 0.4.0
- CVE-2019-1003084A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form vaMaven · org.jenkins-ci.plugins:zephyr-enterprise-test-management · fixed in 1.8
- CVE-2019-1003085A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method Maven · org.jenkins-ci.plugins:zephyr-enterprise-test-management · fixed in 1.8
- CVE-2019-1003086A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection foMaven · org.jenkins-ci.plugins:sinatra-chef-builder
- CVE-2019-1003087A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation meMaven · org.jenkins-ci.plugins:sinatra-chef-builder
- CVE-2019-1003088Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed bMaven · egor-n:fabric-beta-publisher
- CVE-2019-1003089Jenkins Upload to pgyer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by userMaven · ren.helloworld:upload-pgyer · fixed in 1.33
- CVE-2019-1003090A cross-site request forgery vulnerability in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validatiMaven · com.soasta.jenkins:cloudtest
- CVE-2019-1003091A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allowsMaven · com.soasta.jenkins:cloudtest
- CVE-2019-1003092A cross-site request forgery vulnerability in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method Maven · org.jenkins-ci.plugins:nomad · fixed in 0.5.1
- CVE-2019-1003093A missing permission check in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackersMaven · org.jenkins-ci.plugins:nomad · fixed in 0.6.3
- CVE-2019-1003094Jenkins Open STF Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by usMaven · org.jenkins-ci.plugins:open-stf
- CVE-2019-1003095Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vieweMaven · org.jenkins-ci.plugins:perfectomobile
- CVE-2019-1003096Jenkins TestFairy Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users withMaven · org.jenkins-ci.plugins:testfairy · fixed in 4.17.2
- CVE-2019-1003097Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where theyMaven · com.ds.tools.hudson:crowd
- CVE-2019-1003098A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation Maven · org.jenkins-ci.plugins:openid · fixed in 2.4
- CVE-2019-1003099A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows atMaven · org.jenkins-ci.plugins:openid · fixed in 2.4
- CVE-2019-10277Jenkins StarTeam Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Maven · hudson.plugins:starteam
- CVE-2019-10278A cross-site request forgery vulnerability in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validationMaven · org.jenkins-ci.plugins:jenkins-reviewbot
- CVE-2019-10279A missing permission check in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows aMaven · org.jenkins-ci.plugins:jenkins-reviewbot
- CVE-2019-10280Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they canMaven · org.jenkins-ci.plugins:assembla-auth · fixed in 1.13
- CVE-2019-10281Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master Maven · org.jenkins-ci.plugins:relution-publisher
- CVE-2019-10282Jenkins Klaros-Testmanagement Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed bMaven · hudson.plugins.klaros:klaros-testmanagement · fixed in 2.1.0
- CVE-2019-10283Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with ExteMaven · com.mabl.integration.jenkins:mabl-integration · fixed in 0.0.13
- CVE-2019-10284Jenkins Diawi Upload Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users wMaven · org.jenkins-ci.plugins:diawi-upload
- CVE-2019-10285Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed Maven · org.jenkins-ci.plugins:minio-storage
- CVE-2019-10286Jenkins DeployHub Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users withMaven · com.openmake:deployhub · fixed in 8.0.14
- CVE-2019-1003056Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by uMaven · org.jenkins-ci.plugins:websphere-deployer
- CVE-2019-1003057Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vieMaven · org.jenkins-ci.plugins:bitbucket-approve
- CVE-2019-1003058A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attMaven · org.jvnet.hudson.plugins:ftppublisher