ExecuTorch versions prior to 0.7.0 and 0.7.0-rc1 contain a heap-based buffer overflow vulnerability in the method loading process. This flaw can cause the runtime to crash and may allow an attacker to execute arbitrary code or cause other harmful effects. The vulnerability is tracked as CVE-2025-30402 and has a high severity rating with a CVSS score of 8.1. A fix is available in versions 0.7.0 and 0.7.0-rc1.
Apache Commons Lang versions 2.0 through 2.6 and 3.0 through before 3.18.0 contain an uncontrolled recursion vulnerability in the ClassUtils.getClass(...) method. This flaw can cause a StackOverflowError when processing very long inputs, potentially causing applications to stop unexpectedly. The issue is fixed in version 3.18.0.
Jenkins Applitools Eyes Plugin versions 1.16.5 and earlier expose Applitools API keys in the job configuration form without masking them. This vulnerability increases the risk that attackers with access to the Jenkins interface could observe and capture these sensitive API keys. The issue has a medium severity with a CVSS score of 4.3, reflecting limited confidentiality impact and requiring low privileges for exploitation. No official patch or fix is currently indicated in the available data.
Jenkins Applitools Eyes Plugin versions 1.16.5 and earlier store Applitools API keys unencrypted in job config.xml files on the Jenkins controller. These keys can be accessed by users with Item/Extended Read permission or by anyone with access to the Jenkins controller file system. This exposure could lead to unauthorized disclosure of sensitive API keys.
The Jenkins User1st uTester Plugin version 1.1 and earlier stores the uTester JWT token unencrypted in the global configuration file on the Jenkins controller. This token can be accessed by users who have file system access to the Jenkins controller, potentially exposing sensitive authentication information.
Jenkins Xooa Plugin versions 0.0.7 and earlier do not mask the Xooa Deployment Token in the global configuration form. This lack of masking increases the risk that an attacker with access to the configuration interface could observe and capture the token, potentially leading to unauthorized use. The vulnerability has a medium severity rating with a CVSS score of 4.3.
Jenkins Xooa Plugin versions 0.0.7 and earlier store the Xooa Deployment Token unencrypted in the global configuration file on the Jenkins controller. This token can be accessed by any user with file system access to the Jenkins controller, potentially exposing sensitive credentials.
The Jenkins Warrior Framework Plugin version 1.2 and earlier stores passwords in an unencrypted form within job config.xml files on the Jenkins controller. These passwords can be accessed by users who have Item/Extended Read permissions or by anyone with access to the Jenkins controller's file system. This vulnerability exposes sensitive credentials to unauthorized viewing.
Jenkins VAddy Plugin versions 1.2.8 and earlier do not mask Vaddy API authentication keys in the job configuration form. This vulnerability allows these keys to be visible in plaintext, increasing the risk that an attacker with access to the job configuration could observe and capture them. The vulnerability has a medium severity rating with a CVSS score of 4.3.
The Jenkins Sensedia API Platform Plugin version 1.0 does not mask the Sensedia API Manager integration token on its global configuration form. This lack of masking increases the risk that an attacker with access to the configuration interface could observe and capture the token. The vulnerability has a medium severity rating with a CVSS score of 4.3, indicating limited confidentiality impact without affecting integrity or availability.
The Jenkins Sensedia API Platform Plugin version 1.0 and earlier stores the Sensedia API Manager integration token unencrypted in a global configuration XML file on the Jenkins controller. This token is also displayed in the global configuration form without masking, allowing users with access to the Jenkins controller file system or the configuration UI to view the token. There is no fix available as of the advisory publication date.
Jenkins Nouvola DiveCloud Plugin versions 1.08 and earlier do not mask DiveCloud API Keys and Credentials Encryption Keys in the job configuration form. This vulnerability allows these sensitive keys to be visible, increasing the risk of unauthorized observation and potential capture by attackers. The issue has a medium severity with a CVSS score of 4.3.
Jenkins Kryptowire Plugin versions 0.2 and earlier store the Kryptowire API key unencrypted in a global configuration file on the Jenkins controller. This allows users with file system access to the Jenkins controller to view the API key. No fix is currently available for this vulnerability.
Jenkins Nouvola DiveCloud Plugin versions 1.08 and earlier store DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins controller. This exposure allows users with Item/Extended Read permission or file system access to view sensitive credentials. The vulnerability has a medium severity with a CVSS score of 4.3.
Jenkins VAddy Plugin versions 1.2.8 and earlier store VAddy API authentication keys unencrypted in job config.xml files on the Jenkins controller. This exposure allows users with Item/Extended Read permissions or access to the Jenkins controller file system to view these sensitive keys. The vulnerability has a medium severity with a CVSS score of 4.3.
The Jenkins IFTTT Build Notifier Plugin version 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job configuration files on the Jenkins controller. These keys can be accessed by users with Item/Extended Read permission or by anyone with access to the Jenkins controller file system. This exposure could lead to unauthorized access to the IFTTT Maker Channel. As of the advisory publication, no fix is available.
Jenkins IBM Cloud DevOps Plugin versions 2.0.16 and earlier store SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller. Users with Item/Extended Read permission or access to the Jenkins controller file system can view these tokens. No fix is currently available for this vulnerability.
Jenkins Dead Man's Snitch Plugin version 0.1 does not mask Dead Man's Snitch tokens in the job configuration form, which could allow attackers with access to view these tokens. This vulnerability has a medium severity score of 4.3 and is related to information exposure (CWE-522).
The Jenkins ReadyAPI Functional Testing Plugin version 1.11 and earlier stores sensitive credentials such as SLM License Access Keys, client secrets, and passwords unencrypted in job config.xml files on the Jenkins controller. These credentials can be accessed by users with Item/Extended Read permissions or by anyone with access to the Jenkins controller file system. Additionally, the job configuration form does not mask these credentials, increasing the risk of exposure. No fix is currently available for this vulnerability.
Jenkins Applitools Eyes Plugin versions 1.16.5 and earlier contain a stored cross-site scripting (XSS) vulnerability due to improper escaping of the Applitools URL on the build page. This flaw allows attackers with Item/Configure permissions to inject malicious scripts. The vulnerability is fixed in version 1.16.6, which rejects URLs containing HTML metacharacters.