Most recent entries from all

EUVD-2026-222756

2026-10-04T01:03:33.848118+00:00

EUVD-2026-222756

fkie_cve-2024-47805

2026-10-04T01:03:33.848155+00:00

Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.

GHSA-62jv-j4w7-5hh8 — Jenkins Credentials plugin reveals encrypted values of credentials to users with Extended Read permission

2026-10-04T01:03:33.848187+00:00

Affected: Maven: org.jenkins-ci.plugins:credentials

Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type (e.g., Certificate credentials, or Secret file credentials from Plain Credentials Plugin) when accessing item `config.xml` via REST API or CLI.

This allows attackers with Item/Extended Read permission to view encrypted `SecretBytes` values in credentials.

This issue is similar to SECURITY-266 in the 2016-05-11 security advisory, which applied to the `Secret` type used for inline secrets and some credentials types.

Credentials Plugin 1381.v2c3a_12074da_b_ redacts the encrypted values of credentials using the `SecretBytes` type in item `config.xml` files.

This fix is only effective on Jenkins 2.479 and newer, LTS 2.462.3 and newer. While Credentials Plugin 1381.v2c3a_12074da_b_ can be installed on Jenkins 2.463 through 2.478 (both inclusive), encrypted values of credentials using the `SecretBytes` type will not be redacted when accessing item `config.xml` via REST API or CLI.

WID-SEC-W-2024-3071 — Jenkins: Mehrere Schwachstellen

2026-10-04T01:03:33.848223+00:00

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Jenkins und verschiedenen Jenkins Plugins ausnutzen, um Informationen offenzulegen Sicherheitsvorkehrungen zu umgehen oder seine Rechte zu erweitern.