Advisories · Weakness
Hard-coded credentials.
Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 3.3 Low
Squash TM Publisher (Squash4Jenkins) Plugin stores passwords stored in plain text
- Hard-coded credentials
<=1.0.0 · no fixed version yet
GHSA-9h79-5m2f-mqj2 · CVE-2022-34213 - CVSS 4.3 Medium
Plaintext Storage of a Password in Jenkins Convertigo Mobile Platform Plugin
- Hard-coded credentials
- CWE-256
<=1.1 · no fixed version yet
GHSA-c8mf-mc3f-2wvc · CVE-2022-34199 - CVSS 6.5 Medium
Insufficiently Protected Credentials via Insecure Temporary File in org.apache.nifi:nifi-single-user-utils
- Hard-coded credentials
<1.16 · fixed in 1.16
GHSA-rvp4-r3g6-8hxq · CVE-2022-26850 - CVSS 7.5 High
Rundeck's Key Storage converter plugin mechanism's encryption layer not working in 4.2.0, 4.2.1, 4.3.0
- Hard-coded credentials
- CWE-256
>=4.2.0, <4.2.2 || >=4.3.0, <4.3.1 · fixed in 4.2.2, 4.3.1
GHSA-hprf-rrwq-jm5c · CVE-2022-31044 - CVSS 5.9 Medium
GE Voluson S8 Service Browser hard-coded credentials
- GE Voluson S8
- Hard-coded credentials
- CVSS 7.5 High
Insufficiently Protected Credentials in PowerJob
- Hard-coded credentials
<3.3.3 · fixed in 3.3.3
GHSA-w4q4-jcm7-g4m6 · CVE-2020-28865 - CVSS 7.1 High
Weak Password Requirements in kromitgmbh/titra
- kromitgmbh/titra
- Hard-coded credentials
-
Hard-coded credentials in Siemens Teamcenter V12.4 and others
- Siemens Teamcenter V12.4
- Siemens Teamcenter V13.0
- Hard-coded credentials
-
Hard-coded credentials in Siemens Spectrum Power 4 and others
- Siemens Spectrum Power 4
- Siemens Spectrum Power 7
- Hard-coded credentials
- CVSS 9.8 CriticalCritical · CVSS 9+
SICUNET Access Controller hard-coded password
- SICUNET Access Controller
- Hard-coded credentials
- CVSS 5.9 Medium
Mechanize before v2.8.5 vulnerable to authorization header leak on port redirect
- Information disclosure
- Hard-coded credentials
<2.8.5 · fixed in 2.8.5
GHSA-64qm-hrgp-pgr9 · CVE-2022-31033 - CVSS 8.8 High
D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' at SetVirtualServerSettings.php
- Hard-coded credentials
- CVSS 9.4 CriticalCritical · CVSS 9+
Hard-coded credentials in Schneider Electric Wiser Smart
- Schneider Electric Wiser Smart
- Hard-coded credentials
- CVSS 8.1 High
Weak password requirements in Dell PowerScale OneFS
- Dell PowerScale OneFS
- Hard-coded credentials
-
Insufficiently protected credentials in https://github.com/curl/curl
- https://github.com/curl/curl
- Hard-coded credentials
- CVSS 5.7 Medium
Insufficiently protected credentials in https://github.com/curl/curl
- https://github.com/curl/curl
- Hard-coded credentials
- CVSS 8.8 High
KUKA KR C4 - Use of Hard-Coded Credentials
- KUKA KR C4
- KSS (KUKA.SystemSoftware)
- Hard-coded credentials
- CVSS 9.8 CriticalCritical · CVSS 9+
KUKA KR C4 - Use of Hard-Coded Credentials
- KUKA KR C4
- KSS (KUKA.SystemSoftware)
- Hard-coded credentials
- CVSS 7.5 High
Ansible Exposes Sensitive Information
- Information disclosure
- Hard-coded credentials
<2.8.19rc1 || >=2.9.0a1, <2.9.18rc1 || >=2.10.0a1, <2.10.6rc1 · fixed in 2.8.19rc1, 2.9.18rc1, 2.10.6rc1
GHSA-5rrg-rr89-x9mv · CVE-2021-20228 - CVSS 5.5 Medium
Jenkins Gem Publisher Plugin stores credentials as plaintext
- Hard-coded credentials
- CWE-256
<=1.0 · no fixed version yet
GHSA-6pqm-pp65-mc26 · CVE-2019-10426 - CVSS 5.5 Medium
Jenkins GitLab Logo Plugin stores credentials unencrypted
- Hard-coded credentials
<1.0.4 · fixed in 1.0.4
GHSA-22rj-q66g-2jg3 · CVE-2019-10429 - CVSS 8.8 High
Plaintext password storage in Jenkins InfluxDB Plugin
- Hard-coded credentials
- CWE-256
<1.22 · fixed in 1.22
GHSA-rv97-r8f7-8wmg · CVE-2019-10329 - CVSS 6.5 Medium
Apache Superset allowed for database connections password leak for authenticated users
- Hard-coded credentials
<1.3.2 · fixed in 1.3.2
GHSA-42q4-9xf9-f67x · CVE-2021-41972 - CVSS 5.5 Medium
Password stored in plain text by Jenkins Nomad Plugin
- Hard-coded credentials
- CWE-256
<0.7.5 · fixed in 0.7.5
GHSA-5c2c-cvg6-ghjm · CVE-2021-21681 - CVSS 5.9 Medium
Liferay Portal and Liferay DXP May Reveal S3 Store's Proxy Password
- Information disclosure
- Hard-coded credentials
<7.0.10.fp97 || >=7.1.0, <7.1.10.fp21 || >=7.2.0, <7.2.10.fp10 || >=7.3.0, <7.3.10.fp1 · fixed in 7.0.10.fp97, 7.1.10.fp21, 7.2.10.fp10, 7.3.10.fp1
GHSA-xx2h-2hf5-v7vv · CVE-2021-29043 - CVSS 6.5 Medium
Passwords stored in plain text by Jenkins Jabber (XMPP) notifier and control Plugin
- Hard-coded credentials
<1.42 · fixed in 1.42
GHSA-79r5-rhrw-7pvh · CVE-2021-21634 - CVSS 7.5 High
ThinkAdmin Admin Panel Access using Default Credentials
- Hard-coded credentials
=6.0 · no fixed version yet
GHSA-cxv7-6jgf-7gwf · CVE-2020-35296 - CVSS 5.5 Medium
Credentials stored in plain text by Jenkins TraceTronic ECU-TEST Plugin
- Hard-coded credentials
<2.24 · fixed in 2.24
GHSA-qvjr-x8fw-hghv · CVE-2021-21612 - CVSS 5.5 Medium
Credentials stored in plain text by Jenkins Bumblebee HP ALM Plugin
- Hard-coded credentials
<4.1.6 · fixed in 4.1.6
GHSA-8v72-qr3h-c6rv · CVE-2021-21614 - CVSS 3.3 Low
Password stored in plain text by Jenkins VMware Lab Manager Slaves Plugin
- Hard-coded credentials
- CWE-256
<=0.2.8 · no fixed version yet
GHSA-cg4h-cfjp-h3x2 · CVE-2020-2319 - CVSS 6.5 Medium
Passwords stored in plain text by Mail Commander Plugin for Jenkins-ci Plugin
- Hard-coded credentials
- CWE-256
<=1.0.0 · no fixed version yet
GHSA-485q-v457-3p58 · CVE-2020-2318 - CVSS 6.5 Medium
Password written to the build log by Jenkins SQLPlus Script Runner Plugin
- Hard-coded credentials
<2.0.13 · fixed in 2.0.13
GHSA-rwh3-5g7v-3c5m · CVE-2020-2312 - CVSS 3.3 Low
Password stored in plain text by Jenkins AppSpider Plugin
- Hard-coded credentials
- CWE-256
<1.0.13 · fixed in 1.0.13
GHSA-rm7r-xv53-xwc3 · CVE-2020-2314 - CVSS 3.3 Low
Access token stored in plain text by Jenkins SMS Notification Plugin
- Hard-coded credentials
<=1.2 · no fixed version yet
GHSA-vwfv-qpw8-83c7 · CVE-2020-2297 - CVSS 3.3 Low
Password stored in plain text by Jenkins couchdb-statistics Plugin
- Hard-coded credentials
<0.4 · fixed in 0.4
GHSA-jrjr-7rf4-3wqh · CVE-2020-2291 - CVSS 8.3 High
Liferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection
- Hard-coded credentials
>=7.0.0, <7.0.10.fp89 || >=7.1.0, <7.1.10.fp17 || >=7.2.0, <7.2.10.fp4 · fixed in 7.0.10.fp89, 7.1.10.fp17, 7.2.10.fp4
GHSA-773f-f929-qgjj · CVE-2020-15841 - CVSS 3.3 Low
Password stored in plain text by Jenkins HP ALM Quality Center Plugin
- Hard-coded credentials
- CWE-256
<=1.6 · no fixed version yet
GHSA-fc3j-cfqv-pfrm · CVE-2020-2218 - CVSS 4.3 Medium
Credentials stored in plain text by Jenkins White Source Plugin
- Hard-coded credentials
- CWE-256
<20.8.1 · fixed in 20.8.1
GHSA-v8v2-fhgv-3vq2 · CVE-2020-2213 - CVSS 4.3 Medium
Password stored in plain text by Jenkins TestComplete support Plugin
- Hard-coded credentials
- CWE-256
<2.5.2 · fixed in 2.5.2
GHSA-r32r-f6wr-cc3w · CVE-2020-2209 - CVSS 4.3 Medium
Secret stored in plain text by Jenkins Slack Upload Plugin
- Hard-coded credentials
- CWE-256
<=1.7 · no fixed version yet
GHSA-656g-hf8v-x2rw · CVE-2020-2208 - CVSS 4.3 Medium
Secret stored in plain text by Jenkins GitHub Coverage Reporter Plugin
- Hard-coded credentials
- CWE-256
<=1.10 · no fixed version yet
GHSA-5r5f-hcwf-r9jh · CVE-2020-2212 - CVSS 5.5 Medium
ActiveMQ Artemis has Insufficiently Protected Credentials
- Information disclosure
- Hard-coded credentials
>=2.7.0, <2.13.0 · fixed in 2.13.0
GHSA-q9g8-9hpp-xc82 · CVE-2020-10727 - CVSS 6.5 Medium
Openstack cinder Improper handling of ScaleIO backend credentials
- Hard-coded credentials
>=14.0.0, <14.1.0 || >=15.0.0, <15.2.0 || >=16.0.0, <16.1.0 · fixed in 14.1.0, 15.2.0, 16.1.0
GHSA-v3m2-pg96-w33m · CVE-2020-10755 - CVSS 4.3 Medium
Missing permission check in Jenkins Project Inheritance Plugin
- Hard-coded credentials
<=21.04.03 · no fixed version yet
GHSA-w53q-r5cw-6vjh · CVE-2020-2198 - CVSS 3.1 Low
Improper masking of some secrets in Jenkins Credentials Binding Plugin
- Hard-coded credentials
<1.23 · fixed in 1.23
GHSA-7ff8-qfwx-8gx5 · CVE-2020-2182 - CVSS 5.3 Medium
Secrets are not masked by Jenkins Credentials Binding Plugin in builds without build steps
- Hard-coded credentials
<1.23 · fixed in 1.23
GHSA-43j2-r4v3-m8jp · CVE-2020-2181 - CVSS 3.1 Low
Passwords transmitted in plain text by Jenkins Artifactory Plugin
- Weak cryptography or TLS
- Hard-coded credentials
<3.6.1 · fixed in 3.6.1
GHSA-xqf6-5grh-6223 · CVE-2020-2165 - CVSS 3.3 Low
Passwords stored in plain text by Jenkins Artifactory Plugin
- Information disclosure
- Hard-coded credentials
<3.6.0 · fixed in 3.6.0
GHSA-4q47-ph87-fq4f · CVE-2020-2164 - CVSS 3.3 Low
Credentials stored in plain text by Zephyr Enterprise Test Management Plugin
- Hard-coded credentials
- CWE-256
<1.10 · fixed in 1.10
GHSA-xv58-gp43-6m76 · CVE-2020-2145 - CVSS 4.3 Medium
Passwords stored in plain text by Harvest SCM Plugin
- Hard-coded credentials
- CWE-256
<=0.5.1 · no fixed version yet
GHSA-qj7p-9hgf-x8j7 · CVE-2020-2131 - CVSS 4.3 Medium
Passwords stored in plain text by Harvest SCM Plugin
- Hard-coded credentials
- CWE-256
<=0.5.1 · no fixed version yet
GHSA-jmp9-f42q-4g85 · CVE-2020-2130 - CVSS 4.3 Medium
Password stored in plain text by Applatix Plugin
- Hard-coded credentials
- CWE-256
<=1.1 · no fixed version yet
GHSA-54m9-h7qp-fwvg · CVE-2020-2133 - CVSS 6.5 Medium
Plaintext Storage of a Password in Jenkins Eagle Tester Plugin
- Hard-coded credentials
- CWE-256
<=1.0.9 · no fixed version yet
GHSA-vj6f-q4w6-qx9p · CVE-2020-2129 - CVSS 4.3 Medium
Password stored in plain text by Dynamic Extended Choice Parameter Plugin
- Hard-coded credentials
- CWE-256
<=1.0.1 · no fixed version yet
GHSA-h6pp-v4j6-w76c · CVE-2020-2124 - CVSS 4.3 Medium
Password stored in plain text by Parasoft Environment Manager Plugin
- Hard-coded credentials
- CWE-256
<2.15 · fixed in 2.15
GHSA-gmg2-3w6v-945p · CVE-2020-2132 - CVSS 3.3 Low
Token stored in plain text by DigitalOcean Plugin
- Hard-coded credentials
- CWE-256
<1.2.0 · fixed in 1.2.0
GHSA-8g6v-g8qc-5w7j · CVE-2020-2126 - CVSS 4.3 Medium
Password stored in plain text by ECX Copy Data Management Plugin
- Hard-coded credentials
- CWE-256
<=1.9 · no fixed version yet
GHSA-6793-gmp9-2535 · CVE-2020-2128 - CVSS 3.3 Low
Credentials stored in plain text by debian-package-builder Plugin
- Hard-coded credentials
- CWE-256
<=1.6.11 · no fixed version yet
GHSA-64jr-ggw8-h9jc · CVE-2020-2125 - CVSS 3.3 Low
Credential stored in plain text by BMC Release Package and Deployment Plugin
- Hard-coded credentials
- CWE-256
<=1.1 · no fixed version yet
GHSA-2j3r-x6xc-qqqj · CVE-2020-2127 - CVSS 3.1 Low
Client secret transmitted in plain text by Azure AD Plugin
- Hard-coded credentials
- CWE-256
<1.2.0 · fixed in 1.2.0
GHSA-vvg2-hg3c-mqj3 · CVE-2020-2119