Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersJenkins Kryptowire Plugin vulnerability stores unencrypted Kryptowire API key
Jenkins Dead Man's Snitch Plugin vulnerability stores tokens in plain text
Jenkins Nouvola DiveCloud Plugin vulnerability does not mask keys on its job configuration form
Jenkins Applitools Eyes Plugin vulnerable to XSS through its Build page
Jenkins QMetry Test Management Plugin vulnerability exposes API keys
Jenkins Dead Man's Snitch Plugin vulnerability does not mask tokens
Jenkins QMetry Test Management Plugin stores unencrypted API keys
Jenkins ReadyAPI Functional Testing Plugin vulnerability exposes secrets
Jenkins VAddy Plugin vulnerability exposes unencrypted keys to certain authenticated users
Jenkins Nouvola DiveCloud Plugin vulnerability stores unencrypted credentials
Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens
Jenkins IBM Cloud DevOps Plugin vulnerability exposes SonarQube authentication tokens
Jenkins IFTTT Build Notifier Plugin vulnerability exposes IFTTT Maker Channel Keys
Jenkins Statistics Gatherer Plugin vulnerability exposes AWS Secret Key
Jenkins Aqua Security Scanner Plugin vulnerability exposes scanner tokens
Jenkins Git Parameter Plugin vulnerable to code injection due to inexhaustive parameter check
Jenkins HTML Publisher Plugin vulnerability displays controller file system information in its logs
Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages
Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint
junit-platform-reporting can leak Git credentials through its OpenTestReportGeneratingListener
Graylog vulnerable to privilege escalation through API tokens
Conductor vulnerable to OS command injection through unrestricted access to Java classes
Janssen Config API returns results without scope verification
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.