Advisories · Weakness
Hard-coded credentials.
Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 3.1 Low
Jenkins S3 Publisher Plugin transmits credentials in plain text during configuration
- Weak cryptography or TLS
- Hard-coded credentials
<0.11.5 · fixed in 0.11.5
GHSA-ffr6-8cv5-j637 · CVE-2020-2114 - CVSS 4.3 Medium
Fortify Plugin stored credentials in plain text
- Hard-coded credentials
- CWE-256
<19.2.30 · fixed in 19.2.30
GHSA-xr37-pjfh-qwwc · CVE-2020-2107 - CVSS 4.3 Medium
Redgate SQL Change Automation Plugin stored credentials in plain text
- Hard-coded credentials
<2.0.5 · fixed in 2.0.5
GHSA-x23m-8c2h-6wg7 · CVE-2020-2095 - CVSS 9.1 CriticalCritical · CVSS 9+
keycloak vulnerable to unauthorized login via mail server setup
- Hard-coded credentials
- CWE-547
<8.0.0 · fixed in 8.0.0
GHSA-cf8f-w2c5-p5jr · CVE-2019-14837 - CVSS 3.3 Low
Jenkins Weibo Plugin stores credentials unencrypted in its global configuration file
- Hard-coded credentials
- CWE-256
<=1.0.1 · no fixed version yet
GHSA-5c97-gxr3-r368 · CVE-2019-16572 - CVSS 6.5 Medium
Jenkins Rundeck Plugin stored credentials in plain text
- Hard-coded credentials
<3.6.6 · fixed in 3.6.6
GHSA-qh3m-c6hw-5hmv · CVE-2019-16556 - CVSS 6.5 Medium
Jenkins Redgate SQL Change Automation Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<2.0.4 · fixed in 2.0.4
GHSA-9hpq-528p-48j3 · CVE-2019-16557 - CVSS 4.3 Medium
Jenkins QMetry for JIRA Plugin stored credentials in plain text
- Hard-coded credentials
<1.13 · fixed in 1.13
GHSA-8mjp-8c2x-3g7w · CVE-2019-16544 - CVSS 6.5 Medium
Jenkins Anchore Container Scanner Plugin vulnerable to Insufficiently Protected Credentials
- Hard-coded credentials
<1.0.20 · fixed in 1.0.20
GHSA-jg29-c2qj-wpm3 · CVE-2019-16542 - CVSS 7.8 High
Jenkins Zulip Plugin vulnerable to Insufficiently Protected Credentials
- Hard-coded credentials
<1.1.1 · fixed in 1.1.1
GHSA-hfjr-m75m-wmh7 · CVE-2019-10476 - CVSS 7.8 High
Jenkins Dynatrace Plugin vulnerable to Insufficiently Protected Credentials
- Hard-coded credentials
<2.1.4 · fixed in 2.1.4
GHSA-6xw9-qq9h-cr68 · CVE-2019-10461 - CVSS 7.8 High
Jenkins Bitbucket OAuth Plugin contains Insufficiently Protected Credentials
- Hard-coded credentials
<0.10 · fixed in 0.10
GHSA-84h6-jf8x-ff2j · CVE-2019-10460 - CVSS 6.5 Medium
Jenkins Sonar Gerrit Plugin stores credentials unencrypted
- Hard-coded credentials
<2.4.5 · fixed in 2.4.5
GHSA-6fv3-w7j6-5xfc · CVE-2019-10467 - CVSS 6.5 Medium
Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token
- Hard-coded credentials
<2.7.1 · fixed in 2.7.1
GHSA-xcj6-4355-2823 · CVE-2019-10459 - CVSS 8.8 High
Cleartext Storage of Sensitive Information in Jenkins Extensive Testing Plugin
- Information disclosure
- Hard-coded credentials
=1.4.4b · no fixed version yet
GHSA-8x6c-375h-pm4f · CVE-2019-10448 - CVSS 3.3 Low
Jenkins elOyente Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<=1.3 · no fixed version yet
GHSA-jv62-6xvc-ccwh · CVE-2019-10424 - CVSS 4.3 Medium
Jenkins Google Calendar Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<=0.4 · no fixed version yet
GHSA-8gq4-x72r-6xcr · CVE-2019-10425 - CVSS 3.3 Low
Jenkins Assembla Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<=1.4 · no fixed version yet
GHSA-mhq6-h9m7-wq8c · CVE-2019-10420 - CVSS 3.3 Low
Jenkins CodeScan Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<=1.0 · no fixed version yet
GHSA-jp8r-jh5j-cgwf · CVE-2019-10423 - CVSS 4.3 Medium
Jenkins Call Remote Job Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<=1.0.21 · no fixed version yet
GHSA-j8c7-fm85-6jj6 · CVE-2019-10422 - CVSS 3.3 Low
Jenkins vFabric Application Director Plugin Insufficiently Protected Credentials
- Hard-coded credentials
<=1.3 · no fixed version yet
GHSA-hx82-2ggv-vwm5 · CVE-2019-10419 - CVSS 4.3 Medium
Jenkins Git Changelog Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<2.18 · fixed in 2.18
GHSA-h27g-72mh-9m33 · CVE-2019-10414 - CVSS 4.3 Medium
Jenkins Violation Comments to GitLab Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<2.29 · fixed in 2.29
GHSA-8hwr-589g-xpj2 · CVE-2019-10415 - CVSS 4.3 Medium
Jenkins Azure Event Grid Build Notifier Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<=0.1 · no fixed version yet
GHSA-826h-fxff-hpqf · CVE-2019-10421 - CVSS 4.3 Medium
Violation Comments to GitLab Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<2.29 · fixed in 2.29
GHSA-3p8r-p4q5-mc44 · CVE-2019-10416 - CVSS 4.3 Medium
Jenkins Data Theorem Mobile Security: CI/CD Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<1.4.0 · fixed in 1.4.0
GHSA-jjmv-6fv4-85vf · CVE-2019-10413 - CVSS 3.3 Low
Jenkins Beaker Builder Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<1.10 · fixed in 1.10
GHSA-9678-5f6f-wp3f · CVE-2019-10398 - CVSS 6.5 Medium
Jenkins eggplant-plugin Plugin stores credentials in plain text
- Hard-coded credentials
<=2.2 · no fixed version yet
GHSA-xj63-95xc-jc4v · CVE-2019-10385 - CVSS 3.3 Low
Jenkins TestLink Plugin stores credentials in plain text
- Hard-coded credentials
<=3.16 · no fixed version yet
GHSA-qcfr-65hf-f98x · CVE-2019-10378 - CVSS 6.5 Medium
Jenkins Google Cloud Messaging Notification Plugin stores credentials in plain text
- Hard-coded credentials
<=1.0 · no fixed version yet
GHSA-c3r5-vxj6-62mc · CVE-2019-10379 - CVSS 6.5 Medium
Skytap Cloud CI Plugin stored credentials in plain text
- Hard-coded credentials
<2.07 · fixed in 2.07
GHSA-vp26-4hj6-jrvx · CVE-2019-10366 - CVSS 3.3 Low
Jenkins Maven Release Plug-in Plugin stored credentials in plain text
- Hard-coded credentials
<0.15.0 · fixed in 0.15.0
GHSA-vwx8-qpqh-qwm9 · CVE-2019-10361 - CVSS 5.5 Medium
Plaintext Storage of a Password in Jenkins Configuration as Code Plugin
- Hard-coded credentials
- Information disclosure
<1.25 · fixed in 1.25
GHSA-ggmx-pq89-7mcr · CVE-2019-10345 - CVSS 6.5 Medium
Jenkins Credentials Binding Plugin Stores Passwords in a Recoverable Format
- Hard-coded credentials
- CWE-257
=1.17 · no fixed version yet
GHSA-j7gw-mwfg-vqf4 · CVE-2019-1010241 - CVSS 8.8 High
Stored credentials unencrypted in Jenkins Mashup Portlets Plugin
- Hard-coded credentials
<1.1.0 · fixed in 1.1.0
GHSA-9p5v-6p5f-f28h · CVE-2019-10347 - CVSS 3.3 Low
Jenkins Azure AD Plugin stored the client secret unencrypted
- Hard-coded credentials
<0.3.4 · fixed in 0.3.4
GHSA-jcwj-j574-8j2c · CVE-2019-10318 - CVSS 3.3 Low
Jenkins Twitter Plugin stores credentials in plain text
- Hard-coded credentials
<=0.7 · no fixed version yet
GHSA-x2cx-h7w4-q6x7 · CVE-2019-10313 - CVSS 3.3 Low
Jenkins Aqua MicroScanner Plugin stored credentials in plain text
- Hard-coded credentials
<1.0.6 · fixed in 1.0.6
GHSA-gg8r-24qm-qfch · CVE-2019-10316 - CVSS 3.3 Low
Jenkins Azure PublisherSettings Credentials Plugin stored credentials in plain text
- Hard-coded credentials
<1.5 · fixed in 1.5
GHSA-rfc8-wrrf-wp3w · CVE-2019-10303 - CVSS 8.8 High
Jenkins jira-ext Plugin stores credentials unencrypted
- Hard-coded credentials
- CWE-256
<0.9 · fixed in 0.9
GHSA-chm8-wp3h-f4m3 · CVE-2019-10302 - CVSS 6.5 Medium
Telecommunication Software SAMwin Contact Center Suite Credential SAMwinLIBVB.dll getCurrentDBVersion hard-coded credentials
- Telecommunication Software SAMwin Contact Center Suite
- Hard-coded credentials
- CVSS 8.4 High
Weak Password Requirements in polonel/trudesk
- polonel/trudesk
- Hard-coded credentials
- CVSS 9.1 CriticalCritical · CVSS 9+
Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise
- rundeck
- Hard-coded credentials
- CVSS 8.8 High
Hard-coded credentials in Lenovo Personal Cloud Storage A1 and others
- Lenovo Personal Cloud Storage A1
- Lenovo Personal Cloud Storage T1
- Hard-coded credentials
- CVSS 6.8 Medium
Hard-coded credentials in Lenovo Personal Cloud Storage A1 and others
- Lenovo Personal Cloud Storage A1
- Lenovo Personal Cloud Storage T1
- Hard-coded credentials
- CVSS 5.3 Medium
Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin
- Hard-coded credentials
<1.25.4 · fixed in 1.25.4
GHSA-g74w-93cp-5p3p · CVE-2022-30952 - CVSS 9.8 CriticalCritical · CVSS 9+
Katello uses hard coded credential
- Hard-coded credentials
<1.0.6 || >=1.1.0, <1.1.7 · fixed in 1.0.6, 1.1.7
GHSA-5xv2-q475-rwrh · CVE-2012-3503 - CVSS 4.3 Medium
Jenkins AWS CodeDeploy Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<1.20 · fixed in 1.20
GHSA-644j-jcc4-crx7 · CVE-2018-1000402 - CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Improper Access Control in Apache Shiro
- Broken access control
- Hard-coded credentials
<1.2.5 · fixed in 1.2.5
GHSA-p836-389h-j692 · CVE-2016-4437 -
Use of Hard-coded Cryptographic Key in Apache Tomcat
- Hard-coded credentials
>=5.5.0, <5.5.34 || >=6.0.0, <6.0.33 || >=7.0.0, <7.0.12 · fixed in 5.5.34, 6.0.33, 7.0.12
GHSA-6cr4-7c7p-p3xv · CVE-2011-5064 - CVSS 9.8 CriticalCritical · CVSS 9+
Account takeover in facturascripts
- Hard-coded credentials
- CWE-1125
<2022.08 · fixed in 2022.08
GHSA-vjq3-x3f2-fvxq · CVE-2022-1715 -
Hard-coded cryptographic key in SonicWall SMA1000
- SonicWall SMA1000
- Hard-coded credentials
- CVSS 8.8 High
Jenkins Configuration as Code Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<0.8-alpha · fixed in 0.8-alpha
GHSA-8486-h39x-cx2f · CVE-2018-1000610 - CVSS 3.3 Low
Jenkins z/OS Connector Plugin allows local attacker to retrieve configured password
- Hard-coded credentials
<2.0.0 · fixed in 2.0.0
GHSA-5fq9-x9f4-x2r2 · CVE-2018-1000608 - CVSS 7.8 High
AWS CodeDeploy Plugin stored AWS Secret Key in plain text
- Hard-coded credentials
<1.20 · fixed in 1.20
GHSA-h66p-m766-33fv · CVE-2018-1000403 - CVSS 7.8 High
Jenkins AWS CodePipeline Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<0.37 · fixed in 0.37
GHSA-5gwq-4275-q4qc · CVE-2018-1000401 - CVSS 7.8 High
Insufficiently Protected Credentials in Jenkins AWS CodeBuild Plugin
- Hard-coded credentials
<0.27 · fixed in 0.27
GHSA-mwg7-69hf-vqh3 · CVE-2018-1000404 - CVSS 9.8 CriticalCritical · CVSS 9+
Weak Password Requirements in UnboundID LDAP SDK
- Hard-coded credentials
>=1.1.0, <4.0.5 · fixed in 4.0.5
GHSA-qwq9-8rpf-8mp7 · CVE-2018-1000134 - CVSS 2.7 Low
Jenkins Coverity Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<1.11.0 · fixed in 1.11.0
GHSA-cghg-jcv6-4v5m · CVE-2018-1000104 - CVSS 4.3 Medium
Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<1.15 · fixed in 1.15
GHSA-38xm-xhvj-q2qf · CVE-2018-1000057