Romuald Moisan

**Name of the Vulnerable Software and Affected Versions:** Jenkins Sensedia Api Platform Tools Plugin version 1.0 **Description:** The Jenkins Sensedia Api Platform Tools Plugin stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins controller. This allows users with access to the Jenkins controller file system to view the token. **Recommendations:** Ensure the Jenkins controller file system is adequately secured to prevent unauthorized access.

Name of the Vulnerable Software and Affected Versions: Jenkins Xooa Plugin versions 0.0.7 and earlier Description: The Jenkins Xooa Plugin does not mask the Xooa Deployment Token on the global configuration form, potentially allowing attackers to observe and capture it. Recommendations: Update to a newer version of the Jenkins Xooa Plugin to address this issue.

**Name of the Vulnerable Software and Affected Versions:** Jenkins Xooa Plugin versions 0.0.7 and earlier **Description:** The Jenkins Xooa Plugin stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller. This allows users with access to the Jenkins controller file system to view the token. **Recommendations:** Update to a newer version of the Jenkins Xooa Plugin.

**Name of the Vulnerable Software and Affected Versions:** Jenkins Warrior Framework Plugin versions 1.2 and earlier **Description:** The Jenkins Warrior Framework Plugin stores passwords unencrypted in job config.xml files on the Jenkins controller. This allows users with Item/Extended Read permission or access to the Jenkins controller file system to view the passwords. **Recommendations:** Update to a newer version of the Jenkins Warrior Framework Plugin.

Name of the Vulnerable Software and Affected Versions: Jenkins Statistics Gatherer Plugin versions 2.0.3 and earlier Description: The Jenkins Statistics Gatherer Plugin stores the AWS Secret Key unencrypted in its global configuration file `org.jenkins.plugins.statistics.gatherer.StatisticsConfiguration.xml` on the Jenkins controller. This key is accessible to users with access to the Jenkins controller file system and is not masked in the global configuration form. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions:** Jenkins Statistics Gatherer Plugin versions 2.0.3 and earlier **Description:** The Jenkins Statistics Gatherer Plugin does not mask the AWS Secret Key on the global configuration form and stores it unencrypted in the `org.jenkins.plugins.statistics.gatherer.StatisticsConfiguration.xml` configuration file on the Jenkins controller. This allows users with access to the Jenkins controller file system to view the key, and increases the potential for attackers to observe and capture it. **Recommendations:** For versions prior to 2.0.3, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions:** Jenkins ReadyAPI Functional Testing Plugin versions 1.11 and earlier **Description:** The Jenkins ReadyAPI Functional Testing Plugin stores sensitive information, including SLM License Access Keys, client secrets, and passwords, in unencrypted format within job config.xml files on the Jenkins controller. This allows users with Item/Extended Read permission or file system access to view these credentials. **Recommendations:** Versions prior to 1.11: Ensure that access to the Jenkins controller file system is restricted to authorized personnel only. Limit Item/Extended Read permissions to only those users who require access to job configurations.

**Name of the Vulnerable Software and Affected Versions:** Jenkins ReadyAPI Functional Testing Plugin versions 1.11 and earlier **Description:** The Jenkins ReadyAPI Functional Testing Plugin does not properly mask sensitive information such as SLM License Access Keys, client secrets, and passwords on the job configuration form. This increases the risk of unauthorized observation and capture of these credentials. **Recommendations:** Upgrade to Jenkins ReadyAPI Functional Testing Plugin version 1.12 or later.

Name of the Vulnerable Software and Affected Versions: Jenkins IBM Cloud DevOps Plugin versions 2.0.16 and earlier Description: The Jenkins IBM Cloud DevOps Plugin stores SonarQube authentication tokens unencrypted in job `config.xml` files on the Jenkins controller. These tokens are accessible to users with Item/Extended Read permission or those with access to the Jenkins controller file system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions:** Jenkins Dead Man's Snitch Plugin version 0.1 **Description:** The Jenkins Dead Man's Snitch Plugin version 0.1 stores Dead Man's Snitch tokens unencrypted in `job config.xml` files on the Jenkins controller. This allows users with Item/Extended Read permission or access to the Jenkins controller file system to view the tokens. **Recommendations:** Update to a newer version of the Jenkins Dead Man's Snitch Plugin that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Jenkins Sensedia Api Platform Tools Plugin version 1.0 Description: The Jenkins Sensedia Api Platform Tools Plugin does not mask the Sensedia API Manager integration token on the global configuration form, potentially allowing attackers to observe and capture it. Recommendations: Ensure the Sensedia API Manager integration token on the global configuration form is properly masked.

**Name of the Vulnerable Software and Affected Versions:** Jenkins VAddy Plugin versions prior to 1.2.9 **Description:** The Jenkins VAddy Plugin stores VAddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller. These keys are accessible to users with Item/Extended Read permission or those with access to the Jenkins controller file system. **Recommendations:** Upgrade to Jenkins VAddy Plugin version 1.2.9 or later.

### Name of the Vulnerable Software and Affected Versions: Jenkins VAddy Plugin versions 1.2.8 and earlier ### Description: The Jenkins VAddy Plugin does not mask Vaddy API Auth Keys displayed on the job configuration form, potentially allowing attackers to observe and capture them. ### Recommendations: Update to a newer version of the Jenkins VAddy Plugin to address this issue.

**Name of the Vulnerable Software and Affected Versions:** Jenkins Nouvola DiveCloud Plugin versions prior to 1.09 **Description:** The Jenkins Nouvola DiveCloud Plugin stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in `config.xml` files on the Jenkins controller. Users with Item/Extended Read permission or access to the Jenkins controller file system can view these keys. **Recommendations:** Upgrade to Jenkins Nouvola DiveCloud Plugin version 1.09 or later.

Name of the Vulnerable Software and Affected Versions: Jenkins Nouvola DiveCloud Plugin versions 1.08 and earlier Description: The Jenkins Nouvola DiveCloud Plugin does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, potentially allowing attackers to observe and capture them. Recommendations: For versions prior to 1.08, ensure that DiveCloud API Keys and Credentials Encryption Keys are not exposed on the job configuration form.

**Name of the Vulnerable Software and Affected Versions:** Jenkins Kryptowire Plugin versions 0.2 and earlier **Description:** The Jenkins Kryptowire Plugin stores the Kryptowire API key unencrypted in its global configuration file `org.aerogear.kryptowire.GlobalConfigurationImpl.xml` on the Jenkins controller. This allows users with access to the Jenkins controller file system to view the API key. **Recommendations:** Versions prior to 0.3 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions:** Jenkins Dead Man's Snitch Plugin version 0.1 **Description:** The Jenkins Dead Man's Snitch Plugin does not mask Dead Man's Snitch tokens displayed on the job configuration form, potentially allowing attackers to observe and capture them. **Recommendations:** Update to a newer version of the Jenkins Dead Man's Snitch Plugin that addresses this issue.

**Name of the Vulnerable Software and Affected Versions** Jenkins AsakusaSatellite Plugin versions 0.1.1 and earlier **Description** The issue concerns the storage of AsakusaSatellite API keys in an unencrypted manner within job config.xml files on the Jenkins controller. This allows users with Item/Extended Read permission or access to the Jenkins controller file system to view these keys. **Recommendations** For Jenkins AsakusaSatellite Plugin versions 0.1.1 and earlier, consider restricting access to the Jenkins controller file system and limiting Item/Extended Read permissions to minimize exposure of the unencrypted AsakusaSatellite API keys until a fix is available.

**Name of the Vulnerable Software and Affected Versions** Jenkins Stack Hammer Plugin versions 1.0.6 and earlier **Description** The issue concerns the storage of Stack Hammer API keys in an unencrypted manner within job config.xml files on the Jenkins controller. This allows users with Extended Read permission or access to the Jenkins controller file system to view these keys. **Recommendations** For Jenkins Stack Hammer Plugin versions 1.0.6 and earlier, consider restricting access to the Jenkins controller file system and limiting Extended Read permissions to minimize exposure of the unencrypted Stack Hammer API keys until a fix is available.

**Name of the Vulnerable Software and Affected Versions** Jenkins Cadence vManager Plugin versions 4.0.0-282.v5096a c2db 275 and earlier **Description** The issue concerns the storage of Verisium Manager vAPI keys in an unencrypted form within job config.xml files on the Jenkins controller. These keys can be accessed by users who have Extended Read permission or direct access to the Jenkins controller file system. **Recommendations** For versions 4.0.0-282.v5096a c2db 275 and earlier, consider restricting access to the Jenkins controller file system and limiting Extended Read permissions to minimize exposure of the unencrypted vAPI keys until a fix is available.