# Vulnerabilities published in 2019


- [CVE-2019-10464](https://insights.sbomify.com/CVE-2019-10464/): Jenkins Deploy WebLogic Plugin cross-site request forgery vulnerability (high 8.8)
- [CVE-2019-10463](https://insights.sbomify.com/CVE-2019-10463/): Jenkins Dynatrace Plugin contains Incorrect Default Permissions (medium 6.5)
- [CVE-2019-10462](https://insights.sbomify.com/CVE-2019-10462/): Jenkins Dynatrace Plugin vulnerable to Cross-Site Request Forgery (high 8.1)
- [CVE-2019-10461](https://insights.sbomify.com/CVE-2019-10461/): Jenkins Dynatrace Plugin vulnerable to Insufficiently Protected Credentials (high 7.8)
- [CVE-2019-10460](https://insights.sbomify.com/CVE-2019-10460/): Jenkins Bitbucket OAuth Plugin contains Insufficiently Protected Credentials (high 7.8)
- [CVE-2019-1046](https://insights.sbomify.com/CVE-2019-1046/): Windows GDI Information Disclosure Vulnerability (medium 4.7)
- [CVE-2019-10459](https://insights.sbomify.com/CVE-2019-10459/): Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token (medium 6.5)
- [CVE-2019-10458](https://insights.sbomify.com/CVE-2019-10458/): Incorrect Authorization in Puppet Enterprise Pipeline Jenkins Plugin (critical 9.9)
- [CVE-2019-10457](https://insights.sbomify.com/CVE-2019-10457/): Missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin (medium 4.3)
- [CVE-2019-10456](https://insights.sbomify.com/CVE-2019-10456/): Jenkins Oracle Cloud Infrastructure Compute Classic Plugin cross-site request forgery vulnerability (medium 4.3)
- [CVE-2019-10455](https://insights.sbomify.com/CVE-2019-10455/): Missing permission check in Jenkins Rundeck Plugin (medium 4.3)
- [CVE-2019-10454](https://insights.sbomify.com/CVE-2019-10454/): Jenkins Rundeck Plugin CSRF vulnerability (medium 4.3)
- [CVE-2019-10453](https://insights.sbomify.com/CVE-2019-10453/): Jenkins Delphix Plugin vulnerable to Cleartext credential storage (high 7.8)
- [CVE-2019-10452](https://insights.sbomify.com/CVE-2019-10452/): Jenkins View26 Test-Reporting Plugin stores access token in plain text (medium 4.3)
- [CVE-2019-10451](https://insights.sbomify.com/CVE-2019-10451/): Jenkins SOASTA CloudTest Plugin stores API token in plain text (medium 4.3)
- [CVE-2019-10450](https://insights.sbomify.com/CVE-2019-10450/): Cleartext Storage of Sensitive Information in Jenkins ElasticBox CI Plugin (low 3.3)
- [CVE-2019-1045](https://insights.sbomify.com/CVE-2019-1045/): Windows Network File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2019-10449](https://insights.sbomify.com/CVE-2019-10449/): Jenkins Fortify on Demand Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10448](https://insights.sbomify.com/CVE-2019-10448/): Cleartext Storage of Sensitive Information in Jenkins Extensive Testing Plugin (high 8.8)
- [CVE-2019-10447](https://insights.sbomify.com/CVE-2019-10447/): Jenkins Sofy.AI Plugin stores API token in plain text (medium 4.3)
- [CVE-2019-10446](https://insights.sbomify.com/CVE-2019-10446/): Jenkins Cadence vManager Plugin disables SSL/TLS and hostname verification (high 8.2)
- [CVE-2019-10445](https://insights.sbomify.com/CVE-2019-10445/): Missing permission checks in Google Kubernetes Engine Jenkins Plugin (medium 4.3)
- [CVE-2019-10444](https://insights.sbomify.com/CVE-2019-10444/): Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation (medium 6.5)
- [CVE-2019-10443](https://insights.sbomify.com/CVE-2019-10443/): Jenkins iceScrum Plugin stores credentials in Cleartext (high 8.8)
- [CVE-2019-10442](https://insights.sbomify.com/CVE-2019-10442/): Jenkins iceScrum Plugin vulnerable to Missing Authorization (medium 4.3)
- [CVE-2019-10441](https://insights.sbomify.com/CVE-2019-10441/): Jenkins iceScrum Plugin vulnerable to Cross-site Request Forgery (medium 4.3)
- [CVE-2019-10440](https://insights.sbomify.com/CVE-2019-10440/): Jenkins NeoLoad Plugin stores credentials in cleartext (high 8.8)
- [CVE-2019-1044](https://insights.sbomify.com/CVE-2019-1044/): Windows Secure Kernel Mode Security Feature Bypass Vulnerability (medium 5.3)
- [CVE-2019-10439](https://insights.sbomify.com/CVE-2019-10439/): Jenkins CRX Content Package Deployer Plugin subject to credentials enumeration via Missing Authorization (medium 4.3)
- [CVE-2019-10438](https://insights.sbomify.com/CVE-2019-10438/): Jenkins CRX Content Package Deployer Plugin subject to Missing Authorization (medium 6.5)
- [CVE-2019-10437](https://insights.sbomify.com/CVE-2019-10437/): Jenkins CRX Content Package Deployer Plugin subject to Cross-Site Request Forgery (high 8.8)
- [CVE-2019-10436](https://insights.sbomify.com/CVE-2019-10436/): Improper Limitation of a Pathname to a Restricted Directory in Jenkins Google OAuth Credentials Plugin (medium 6.5)
- [CVE-2019-10435](https://insights.sbomify.com/CVE-2019-10435/): Jenkins SourceGear Vault plugin transmits credentials in plain text (high 7.5)
- [CVE-2019-10434](https://insights.sbomify.com/CVE-2019-10434/): Jenkins LDAP Email Plugin shows plain text password in configuration form (high 7.5)
- [CVE-2019-10433](https://insights.sbomify.com/CVE-2019-10433/): DingTalk Plugin stores credentials in plain text (low 3.3)
- [CVE-2019-10432](https://insights.sbomify.com/CVE-2019-10432/): Jenkins HTML Publisher Plugin vulnerable to Cross-site Scripting (medium 5.4)
- [CVE-2019-10431](https://insights.sbomify.com/CVE-2019-10431/): Improper Control of Generation of Code in Jenkins Script Security Plugin (critical 9.9)
- [CVE-2019-10430](https://insights.sbomify.com/CVE-2019-10430/): Jenkins NeuVector Vulnerability Scanner Plugin stored credentials in plain text (medium 5.5)
- [CVE-2019-1043](https://insights.sbomify.com/CVE-2019-1043/): Comctl32 Remote Code Execution Vulnerability (medium 6.4)
- [CVE-2019-10429](https://insights.sbomify.com/CVE-2019-10429/): Jenkins GitLab Logo Plugin stores credentials unencrypted (medium 5.5)
- [CVE-2019-10428](https://insights.sbomify.com/CVE-2019-10428/): Jenkins Aqua Security Scanner Plugin showed plain text password in configuration form (high 7.5)
- [CVE-2019-10427](https://insights.sbomify.com/CVE-2019-10427/): Jenkins Aqua MicroScanner Plugin showed plain text credential in configuration form (medium 5.3)
- [CVE-2019-10426](https://insights.sbomify.com/CVE-2019-10426/): Jenkins Gem Publisher Plugin stores credentials as plaintext (medium 5.5)
- [CVE-2019-10425](https://insights.sbomify.com/CVE-2019-10425/): Jenkins Google Calendar Plugin has Insufficiently Protected Credentials (medium 6.5)
- [CVE-2019-10424](https://insights.sbomify.com/CVE-2019-10424/): Jenkins elOyente Plugin has Insufficiently Protected Credentials (medium 5.5)
- [CVE-2019-10423](https://insights.sbomify.com/CVE-2019-10423/): Jenkins CodeScan Plugin has Insufficiently Protected Credentials (medium 5.5)
- [CVE-2019-10422](https://insights.sbomify.com/CVE-2019-10422/): Jenkins Call Remote Job Plugin has Insufficiently Protected Credentials (medium 6.5)
- [CVE-2019-10421](https://insights.sbomify.com/CVE-2019-10421/): Jenkins Azure Event Grid Build Notifier Plugin has Insufficiently Protected Credentials (medium 4.3)
- [CVE-2019-10420](https://insights.sbomify.com/CVE-2019-10420/): Jenkins Assembla Plugin has Insufficiently Protected Credentials (medium 5.5)
- [CVE-2019-10419](https://insights.sbomify.com/CVE-2019-10419/): Jenkins vFabric Application Director Plugin Insufficiently Protected Credentials (medium 5.5)
- [CVE-2019-10418](https://insights.sbomify.com/CVE-2019-10418/): Incorrect Authorization in Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin (critical 9.9)
- [CVE-2019-10417](https://insights.sbomify.com/CVE-2019-10417/): Incorrect Authorization in Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin (critical 9.9)
- [CVE-2019-10416](https://insights.sbomify.com/CVE-2019-10416/): Violation Comments to GitLab Plugin has Insufficiently Protected Credentials (medium 6.5)
- [CVE-2019-10415](https://insights.sbomify.com/CVE-2019-10415/): Jenkins Violation Comments to GitLab Plugin has Insufficiently Protected Credentials (medium 6.5)
- [CVE-2019-10414](https://insights.sbomify.com/CVE-2019-10414/): Jenkins Git Changelog Plugin has Insufficiently Protected Credentials (medium 6.5)
- [CVE-2019-10413](https://insights.sbomify.com/CVE-2019-10413/): Jenkins Data Theorem Mobile Security: CI/CD Plugin has Insufficiently Protected Credentials (medium 6.5)
- [CVE-2019-10412](https://insights.sbomify.com/CVE-2019-10412/): Jenkins Inedo ProGet Plugin Plugin has Cleartext Transmission of Sensitive Information (high 7.5)
- [CVE-2019-10411](https://insights.sbomify.com/CVE-2019-10411/): Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form (high 7.5)
- [CVE-2019-10410](https://insights.sbomify.com/CVE-2019-10410/): Jenkins Log Parser Plugin vulnerable to Cross-site Scripting (medium 5.4)
- [CVE-2019-1041](https://insights.sbomify.com/CVE-2019-1041/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2019-10409](https://insights.sbomify.com/CVE-2019-10409/): Missing permission check in Jenkins Project Inheritance Plugin (medium 4.3)
- [CVE-2019-10408](https://insights.sbomify.com/CVE-2019-10408/): Jenkins Project Inheritance Plugin vulnerable to Cross-Site Request Forgery (medium 4.3)
- [CVE-2019-10407](https://insights.sbomify.com/CVE-2019-10407/): Project Inheritance Plugin showed secret environment variables defined in Mask Passwords Plugin (medium 6.5)
- [CVE-2019-10406](https://insights.sbomify.com/CVE-2019-10406/): Improper Neutralization of Input During Web Page Generation in Jenkins (medium 4.8)
- [CVE-2019-10405](https://insights.sbomify.com/CVE-2019-10405/): Exposure of Sensitive Information to an Unauthorized Actor in Jenkins (medium 5.4)
- [CVE-2019-10404](https://insights.sbomify.com/CVE-2019-10404/): Improper Neutralization of Input During Web Page Generation in Jenkins (medium 5.4)
- [CVE-2019-10403](https://insights.sbomify.com/CVE-2019-10403/): Improper Neutralization of Input During Web Page Generation in Jenkins (medium 5.4)
- [CVE-2019-10402](https://insights.sbomify.com/CVE-2019-10402/): Improper Neutralization of Input During Web Page Generation in Jenkins (medium 5.4)
- [CVE-2019-10401](https://insights.sbomify.com/CVE-2019-10401/): Improper Neutralization of Input During Web Page Generation in Jenkins (medium 5.4)
- [CVE-2019-10400](https://insights.sbomify.com/CVE-2019-10400/): Sandbox bypass vulnerability in Jenkins Script Security Plugin (medium 4.2)
- [CVE-2019-1040](https://insights.sbomify.com/CVE-2019-1040/): Windows NTLM Tampering Vulnerability (medium 5.3)
- [CVE-2019-10399](https://insights.sbomify.com/CVE-2019-10399/): Sandbox bypass vulnerability in Jenkins Script Security Plugin (medium 4.2)
- [CVE-2019-10398](https://insights.sbomify.com/CVE-2019-10398/): Jenkins Beaker Builder Plugin has Insufficiently Protected Credentials (medium 5.5)
- [CVE-2019-10397](https://insights.sbomify.com/CVE-2019-10397/): Jenkins Aqua Security Serverless Scanner Plugin showed plain text password in job configuration form fields (low 3.1)
- [CVE-2019-10396](https://insights.sbomify.com/CVE-2019-10396/): Jenkins Dashboard View Plugin vulnerable to Cross-site Scripting (medium 5.4)
- [CVE-2019-10395](https://insights.sbomify.com/CVE-2019-10395/): Jenkins Build Environment Plugin vulnerable to Cross-site Scripting (medium 5.4)
- [CVE-2019-10394](https://insights.sbomify.com/CVE-2019-10394/): Sandbox bypass vulnerability in Jenkins Script Security Plugin (medium 4.2)
- [CVE-2019-10393](https://insights.sbomify.com/CVE-2019-10393/): Sandbox bypass vulnerability in Script Security Plugin (medium 4.2)
- [CVE-2019-10392](https://insights.sbomify.com/CVE-2019-10392/): Improper Neutralization of Special Elements used in an OS Command in Jenkins Git Client Plugin (high 8.8)
- [CVE-2019-10391](https://insights.sbomify.com/CVE-2019-10391/): Jenkins IBM AppScan Plugin showed plain text password in job configuration form fields (medium 6.5)
- [CVE-2019-10390](https://insights.sbomify.com/CVE-2019-10390/): Jenkins Splunk Plugin Sandbox Bypass (high 8.8)
- [CVE-2019-1039](https://insights.sbomify.com/CVE-2019-1039/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2019-10389](https://insights.sbomify.com/CVE-2019-10389/): Missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin (medium 4.3)
- [CVE-2019-10388](https://insights.sbomify.com/CVE-2019-10388/): Relution Enterprise Appstore Publisher Jenkins Plugin contains Cross-Site Request Forgery (medium 4.3)
- [CVE-2019-10387](https://insights.sbomify.com/CVE-2019-10387/): Missing permission check in Jenkins XL TestView Plugin (medium 6.5)
- [CVE-2019-10386](https://insights.sbomify.com/CVE-2019-10386/): Cross-site request forgery vulnerability in Jenkins XL TestView Plugin (high 8.8)
- [CVE-2019-10385](https://insights.sbomify.com/CVE-2019-10385/): Jenkins eggplant-plugin Plugin stores credentials in plain text (medium 6.5)
- [CVE-2019-10384](https://insights.sbomify.com/CVE-2019-10384/): Cross-Site Request Forgery in Jenkins (high 8.8)
- [CVE-2019-10383](https://insights.sbomify.com/CVE-2019-10383/): Improper Neutralization of Input During Web Page Generation in Jenkins (medium 4.8)
- [CVE-2019-10382](https://insights.sbomify.com/CVE-2019-10382/): Jenkins VMware Lab Manager Slaves Plugin vulnerable to Improper Certificate Validation (medium 6.5)
- [CVE-2019-10381](https://insights.sbomify.com/CVE-2019-10381/): Jenkins Codefresh Integration Plugin Improper Certificate Validation vulnerability (high 7.5)
- [CVE-2019-10380](https://insights.sbomify.com/CVE-2019-10380/): Jenkins Simple Travis Pipeline Runner Plugin script sandbox bypass vulnerability (high 8.8)
- [CVE-2019-1038](https://insights.sbomify.com/CVE-2019-1038/): Microsoft Browser Memory Corruption Vulnerability (high 7.5)
- [CVE-2019-10379](https://insights.sbomify.com/CVE-2019-10379/): Jenkins Google Cloud Messaging Notification Plugin stores credentials in plain text (medium 6.5)
- [CVE-2019-10378](https://insights.sbomify.com/CVE-2019-10378/): Jenkins TestLink Plugin stores credentials in plain text (medium 5.3)
- [CVE-2019-10377](https://insights.sbomify.com/CVE-2019-10377/): Missing permission check in Jenkins Avatar Plugin (medium 4.3)
- [CVE-2019-10376](https://insights.sbomify.com/CVE-2019-10376/): Jenkins Wall Display Plugin Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2019-10375](https://insights.sbomify.com/CVE-2019-10375/): Arbitrary file read vulnerability in Jenkins File System SCM Plugin (medium 6.5)
- [CVE-2019-10374](https://insights.sbomify.com/CVE-2019-10374/): Jenkins PegDown Formatter Plugin has Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2019-10373](https://insights.sbomify.com/CVE-2019-10373/): Jenkins Build Pipeline Plugin vulnerable to Cross-site Scripting (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/149/