https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 04:27:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-22308 EUVD-2026-22308 https://cve.radiocsirt.org/vuln/euvd-2026-22308 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21625 <p>Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circumstances.</p> <p>Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circumstances.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-21625 https://cve.radiocsirt.org/vuln/ghsa-jwr9-h4jm-c9ch <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:aws-credentials</p> <p>CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints.</p> <p>This allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins if any of the following plugins are installed:</p> <p>- [Amazon Elastic Container Service (ECS) / Fargate](https://plugins.jenkins.io/amazon-ecs) - [AWS Parameter Store Build Wrapper](https://plugins.jenkins.io/aws-parameter-store) - [AWS SAM](https://plugins.jenkins.io/aws-sam)\n\nFurther plugins may use this helper method as well without performing a permission check themselves.</p> <p>Credentials IDs obtained this way can be used as part of an attack to capture the credentials using another vulnerability.</p> <p>CloudBees AWS Credentials Plugin 1.28.1 performs permission checks in the helper method for HTTP endpoints.</p> <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:aws-credentials</p> <p>CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints.</p> <p>This allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins if any of the following plugins are installed:</p> <p>- [Amazon Elastic Container Service (ECS) / Fargate](https://plugins.jenkins.io/amazon-ecs) - [AWS Parameter Store Build Wrapper](https://plugins.jenkins.io/aws-parameter-store) - [AWS SAM](https://plugins.jenkins.io/aws-sam)\n\nFurther plugins may use this helper method as well without performing a permission check themselves.</p> <p>Credentials IDs obtained this way can be used as part of an attack to capture the credentials using another vulnerability.</p> <p>CloudBees AWS Credentials Plugin 1.28.1 performs permission checks in the helper method for HTTP endpoints.</p> https://cve.radiocsirt.org/vuln/ghsa-jwr9-h4jm-c9ch https://cve.radiocsirt.org/vuln/gsd-2021-21625 gsd-2021-21625 https://cve.radiocsirt.org/vuln/gsd-2021-21625