Jenkins Apica Loadtest Plugin versions 1.10 and earlier store authentication tokens unencrypted in job configuration files on the Jenkins controller. These tokens are accessible to users with Item/Extended Read permission or file system access. The plugin also fails to mask tokens in the job configuration form, increasing exposure risk. No fix is currently available for this vulnerability.
The Jenkins Dead Man's Snitch Plugin version 0.1 stores Dead Man's Snitch tokens in plain text within job config.xml files on the Jenkins controller. These tokens can be accessed by users with Item/Extended Read permission or by anyone with access to the Jenkins controller file system. This exposure could lead to unauthorized disclosure of sensitive tokens.
The Jenkins QMetry Test Management Plugin version 1.13 and earlier stores QMetry Automation API keys unencrypted in job configuration files on the Jenkins controller. These keys are accessible to users with Item/Extended Read permission or those with file system access to the Jenkins controller. The plugin's job configuration form also does not mask the API keys, increasing the risk of exposure. No fix is currently available for this vulnerability.
The Jenkins Testsigma Test Plan run Plugin (version 1.6 and earlier) stores Testsigma API keys in job configuration files on the Jenkins controller. Although these keys are encrypted on disk, the plugin's job configuration form does not mask the API keys, potentially allowing attackers with access to the form to observe and capture them. There is currently no fix available for this issue.
The Jenkins QMetry Test Management Plugin version 1.13 and earlier stores QMetry Automation API keys unencrypted in job configuration files on the Jenkins controller. These keys are accessible to users with Item/Extended Read permission or those with access to the Jenkins controller file system. Additionally, the job configuration form does not mask these API keys, increasing the risk of exposure. No fix is currently available for this vulnerability.
Jenkins Apica Loadtest Plugin versions 1.10 and earlier store authentication tokens unencrypted in job config.xml files on the Jenkins controller. These tokens are accessible to users with Item/Extended Read permission or those with file system access to the Jenkins controller. The job configuration form also does not mask these tokens, increasing the risk of token exposure. No fix is currently available for this vulnerability.
The Jenkins ReadyAPI Functional Testing Plugin version 1.11 and earlier stores sensitive credentials such as SLM License Access Keys, client secrets, and passwords unencrypted in job config.xml files on the Jenkins controller. These credentials can be accessed by users with Item/Extended Read permission or by anyone with access to the Jenkins controller file system. Additionally, the job configuration form does not mask these credentials, increasing the risk of exposure. No fix is currently available for this vulnerability.
The Jenkins Statistics Gatherer Plugin versions 2.0.3 and earlier store the AWS Secret Key unencrypted in the global configuration file on the Jenkins controller. This key is accessible to any user with file system access to the Jenkins controller. Additionally, the plugin's configuration form does not mask the AWS Secret Key, increasing the risk of exposure. No fix is currently available for this vulnerability.
The Jenkins Statistics Gatherer Plugin versions 2.0.3 and earlier store the AWS Secret Key unencrypted in a global configuration XML file on the Jenkins controller. This key is accessible to users with file system access to the controller. Additionally, the plugin's configuration form does not mask the key, increasing the risk of exposure. No fix is currently available for this vulnerability.
Jenkins Aqua Security Scanner Plugin versions 3.2.8 and earlier store Aqua API scanner tokens unencrypted in job config.xml files on the Jenkins controller. These tokens can be accessed by users with Item/Extended Read permissions or by anyone with file system access to the Jenkins controller. This exposure risks unauthorized disclosure of sensitive tokens. No fix is currently available for this vulnerability.
The Jenkins Git Parameter Plugin versions prior to 444.vca contain a vulnerability where the plugin does not validate that the Git parameter value submitted to a build matches one of the predefined choices. This flaw allows attackers with Item/Build permission to inject arbitrary values into Git parameters, potentially leading to code injection. The issue is fixed in version 444.vca.
Jenkins HTML Publisher Plugin versions 425 and earlier expose absolute file system paths of archived files in build log messages during the Publish HTML reports post-build step. This information disclosure was mitigated in version 427, which only logs the parent directory name instead of full paths.
A vulnerability in Jenkins Credentials Binding Plugin versions 687.v619cb_15e923f and earlier allows sensitive credentials to be exposed in build logs because the plugin does not properly mask credentials in exception error messages. This issue is fixed in version 687.689.v1a, which masks credentials in error messages by rethrowing exceptions with masked content.
CVE-2025-49125 is a security constraint bypass vulnerability in Apache Tomcat affecting versions 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.105, 10.1.0-M1 through 10.1.41, and 11.0.0-M1 through 11.0.7. The flaw allows access to PreResources or PostResources mounted at non-root locations via unexpected paths that may not be protected by the intended security constraints, enabling authentication bypass. Fixed versions are 8.5.101+, 9.0.106+, 10.1.42+, and 11.0.8+. The vulnerability has a CVSS 4.0 base score of 6.3 (medium severity).
A denial of service (DoS) vulnerability exists in Apache Commons FileUpload due to allocation of resources for multipart headers without sufficient limits. This affects versions from 1.0 up to but not including 1.6.0, and from 2.0.0-M1 up to but not including 2.0.0-M4. Upgrading to versions 1.6.0 or 2.0.0-M4 resolves the issue.
Apache Tomcat versions from 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.105, 10.1.0-M1 through 10.1.41, and 11.0.0-M1 through 11.0.7 are affected by a denial of service (DoS) vulnerability related to resource allocation without limits or throttling during multipart uploads. This vulnerability can cause the server to exhaust resources, leading to service disruption. Fixed versions are 8.5.101 or later, 9.0.106 or later, 10.1.42 or later, and 11.0.8 or later.
XWiki platform versions starting from 15.9-rc-1 up to but excluding 16.4.7, 16.5.0-rc-1 up to but excluding 16.10.3, and 17.0.0-rc-1 up to but excluding 17.0.0 contain incomplete required rights analyzers for macros. This flaw allows attackers to hide malicious script macros by exploiting unconsidered parameter cases, potentially leading to remote code execution when a user with programming rights edits the page. The issue is fixed in versions 16.4.7, 16.10.3, and 17.0.0. No known workarounds exist other than caution when editing content from untrusted users.
Apache Tomcat versions 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.104, 10.1.0-M1 through 10.1.40, and 11.0.0-M1 through 11.0.6 contain a vulnerability in the CGI servlet where improper handling of case sensitivity allows bypassing security constraints applied to the pathInfo component of a URI. This security constraint bypass is fixed in versions 8.5.101 and later, 9.0.105 and later, 10.1.41 and later, and 11.0.7 and later. The vulnerability has a medium severity with a CVSS score of 6.3.
Apache Commons BeanUtils versions before 1.11.0 (1.x) and before 2.0.0-M2 (2.x) contain an improper access control vulnerability. This flaw allows attackers to access the class loader of Java enum objects via the 'declaredClass' property when property paths from external sources are passed directly to PropertyUtilsBean's getProperty() or getNestedProperty() methods. The vulnerability is fixed by default starting in versions 1.11.0 and 2.0.0-M2 by suppressing access to the 'declaredClass' property through a special BeanIntrospector.
CVE-2025-27533 is a high-severity vulnerability in Apache ActiveMQ affecting versions before 5.16.8, between 5.17.0 and 5.17.7, between 5.18.0 and 5.18.7, and between 6.0.0 and 6.1.6. It involves improper validation of buffer size values during unmarshalling of OpenWire commands, leading to excessive memory allocation. This can be exploited to cause denial of service by depleting process memory, impacting the availability of the ActiveMQ broker. The issue does not affect ActiveMQ 5.19.0 and later fixed versions. Mitigation includes upgrading to fixed versions or implementing mutual TLS to reduce risk on affected brokers.