# Vulnerabilities published in 2019


- [CVE-2019-10372](https://insights.sbomify.com/CVE-2019-10372/): Jenkins Gitlab Authentication Plugin Open Redirect vulnerability (medium 6.1)
- [CVE-2019-10371](https://insights.sbomify.com/CVE-2019-10371/): Jenkins Gitlab Authentication Plugin vulnerable to Session Fixation (high 7.5)
- [CVE-2019-10370](https://insights.sbomify.com/CVE-2019-10370/): Insertion of Sensitive Information into Log File in Jenkins Mask Passwords Plugin (medium 6.5)
- [CVE-2019-1037](https://insights.sbomify.com/CVE-2019-1037/): Privilege escalation in Windows (high 7.0)
- [CVE-2019-10369](https://insights.sbomify.com/CVE-2019-10369/): Jenkins JClouds Plugin missing permission check (medium 6.5)
- [CVE-2019-10368](https://insights.sbomify.com/CVE-2019-10368/): Jenkins JClouds Plugin cross-site request forgery vulnerability (high 8.8)
- [CVE-2019-10367](https://insights.sbomify.com/CVE-2019-10367/): Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin (medium 5.5)
- [CVE-2019-10366](https://insights.sbomify.com/CVE-2019-10366/): Skytap Cloud CI Plugin stored credentials in plain text (medium 6.5)
- [CVE-2019-10365](https://insights.sbomify.com/CVE-2019-10365/): Jenkins Google Kubernetes Engine Plugin vulnerable to Exposure of Resource to Wrong Sphere (medium 4.3)
- [CVE-2019-10364](https://insights.sbomify.com/CVE-2019-10364/): Jenkins Amazon EC2 Plugin leaked beginning of private key in system log (medium 5.5)
- [CVE-2019-10363](https://insights.sbomify.com/CVE-2019-10363/): Cleartext Transmission of Sensitive Information in Jenkins Configuration as Code Plugin (medium 4.9)
- [CVE-2019-10362](https://insights.sbomify.com/CVE-2019-10362/): Improper Encoding or Escaping of Output in Jenkins Configuration as Code Plugin (medium 5.4)
- [CVE-2019-10361](https://insights.sbomify.com/CVE-2019-10361/): Jenkins Maven Release Plug-in Plugin stored credentials in plain text (medium 5.5)
- [CVE-2019-10360](https://insights.sbomify.com/CVE-2019-10360/): Jenkins Maven Release Plugin vulnerable to Cross-site Scripting (medium 5.4)
- [CVE-2019-1036](https://insights.sbomify.com/CVE-2019-1036/): Microsoft Office SharePoint XSS Vulnerability (medium 5.4)
- [CVE-2019-10359](https://insights.sbomify.com/CVE-2019-10359/): Jenkins Maven Release Plugin contains Cross-Site Request Forgery vulnerability (medium 6.3)
- [CVE-2019-10358](https://insights.sbomify.com/CVE-2019-10358/): Maven Integration Plugin did not mask sensitive values in module build logs (medium 6.5)
- [CVE-2019-10357](https://insights.sbomify.com/CVE-2019-10357/): Missing Authorization in Jenkins Pipeline: Shared Groovy Libraries Plugin (medium 4.3)
- [CVE-2019-10356](https://insights.sbomify.com/CVE-2019-10356/): Return of Pointer Value Outside of Expected Rang in Jenkins Script Security Plugin (high 8.8)
- [CVE-2019-10355](https://insights.sbomify.com/CVE-2019-10355/): Incorrect Privilege Assignment in Jenkins Script Security Plugin (high 8.8)
- [CVE-2019-10354](https://insights.sbomify.com/CVE-2019-10354/): Missing Authorization in Jenkins (medium 4.3)
- [CVE-2019-10353](https://insights.sbomify.com/CVE-2019-10353/): Cross-Site Request Forgery in Jenkins (high 7.5)
- [CVE-2019-10352](https://insights.sbomify.com/CVE-2019-10352/): Improper Limitation of a Pathname to a Restricted Directory in Jenkins (medium 6.5)
- [CVE-2019-10351](https://insights.sbomify.com/CVE-2019-10351/): Jenkins Caliper CI Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10350](https://insights.sbomify.com/CVE-2019-10350/): Jenkins Port Allocator Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1035](https://insights.sbomify.com/CVE-2019-1035/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2019-10349](https://insights.sbomify.com/CVE-2019-10349/): Jenkins Dependency Graph Viewer Plugin contains Cross-site Scripting (medium 5.4)
- [CVE-2019-10348](https://insights.sbomify.com/CVE-2019-10348/): Jenkins Gogs Plugin stored credentials in plain text (high 8.8)
- [CVE-2019-10347](https://insights.sbomify.com/CVE-2019-10347/): Stored credentials unencrypted in Jenkins Mashup Portlets Plugin (high 8.8)
- [CVE-2019-10346](https://insights.sbomify.com/CVE-2019-10346/): Jenkins Embeddable Build Status Plugin contains Cross-site Scripting (medium 6.1)
- [CVE-2019-10345](https://insights.sbomify.com/CVE-2019-10345/): Plaintext Storage of a Password in Jenkins Configuration as Code Plugin (medium 5.5)
- [CVE-2019-10344](https://insights.sbomify.com/CVE-2019-10344/): Missing Authorization in Jenkins Configuration as Code Plugin (medium 4.3)
- [CVE-2019-10343](https://insights.sbomify.com/CVE-2019-10343/): Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin (low 3.3)
- [CVE-2019-10342](https://insights.sbomify.com/CVE-2019-10342/): Missing permission check in Jenkins Docker Plugin (medium 4.3)
- [CVE-2019-10341](https://insights.sbomify.com/CVE-2019-10341/): Missing permission check in Jenkins Docker Plugin (medium 6.5)
- [CVE-2019-10340](https://insights.sbomify.com/CVE-2019-10340/): Jenkins Docker Plugin contains Cross-Site Request Forgery (high 8.8)
- [CVE-2019-1034](https://insights.sbomify.com/CVE-2019-1034/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2019-10339](https://insights.sbomify.com/CVE-2019-10339/): Jenkins JX Resources Plugin missing permission check (high 8.8)
- [CVE-2019-10338](https://insights.sbomify.com/CVE-2019-10338/): Jenkins JX Resources Plugin cross-site request forgery vulnerability (high 8.8)
- [CVE-2019-10337](https://insights.sbomify.com/CVE-2019-10337/): Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin (high 7.5)
- [CVE-2019-10336](https://insights.sbomify.com/CVE-2019-10336/): Jenkins ElectricFlow Plugin is vulnerable to reflected cross site scripting vulnerability (medium 6.1)
- [CVE-2019-10335](https://insights.sbomify.com/CVE-2019-10335/): Jenkins ElectricFlow Plugin is vulnerable to stored cross site scripting vulnerability (medium 5.4)
- [CVE-2019-10334](https://insights.sbomify.com/CVE-2019-10334/): Jenkins ElectricFlow Plugin globally and unconditionally disabled SSL/TLS certificate validation (medium 6.5)
- [CVE-2019-10333](https://insights.sbomify.com/CVE-2019-10333/): Jenkins ElectricFlow Plugin Missing permission checks (medium 4.3)
- [CVE-2019-10332](https://insights.sbomify.com/CVE-2019-10332/): Jenkins ElectricFlow Plugin missing permission check (medium 4.3)
- [CVE-2019-10331](https://insights.sbomify.com/CVE-2019-10331/): Jenkins ElectricFlow Plugin cross-site request forgery vulnerability (medium 4.3)
- [CVE-2019-10330](https://insights.sbomify.com/CVE-2019-10330/): Improper handling of untrusted branches in Gitea Jenkins Plugin (high 7.5)
- [CVE-2019-1033](https://insights.sbomify.com/CVE-2019-1033/): Microsoft Office SharePoint XSS Vulnerability (medium 5.4)
- [CVE-2019-10329](https://insights.sbomify.com/CVE-2019-10329/): Plaintext password storage in Jenkins InfluxDB Plugin (high 8.8)
- [CVE-2019-10328](https://insights.sbomify.com/CVE-2019-10328/): Unsafe entry in Script Security list of approved signatures in Pipeline Remote Loader Plugin (critical 9.9)
- [CVE-2019-10327](https://insights.sbomify.com/CVE-2019-10327/): XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin (high 8.1)
- [CVE-2019-10326](https://insights.sbomify.com/CVE-2019-10326/): Jenkins Warnings NG Plugin cross-site request forgery vulnerability (medium 4.3)
- [CVE-2019-10325](https://insights.sbomify.com/CVE-2019-10325/): Jenkins Warnings NG Plugin Cross-site scripting vulnerability (medium 5.4)
- [CVE-2019-10324](https://insights.sbomify.com/CVE-2019-10324/): Cross-site request forgery vulnerability in Jenkins Artifactory Plugin (medium 6.5)
- [CVE-2019-10323](https://insights.sbomify.com/CVE-2019-10323/): Jenkins Artifactory Plugin missing permission check (medium 4.3)
- [CVE-2019-10322](https://insights.sbomify.com/CVE-2019-10322/): Jenkins Artifactory Plugin missing permission check (medium 4.3)
- [CVE-2019-10321](https://insights.sbomify.com/CVE-2019-10321/): Jenkins Artifactory Plugin cross-site request forgery vulnerability (medium 4.3)
- [CVE-2019-10320](https://insights.sbomify.com/CVE-2019-10320/): Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin (medium 4.3)
- [CVE-2019-1032](https://insights.sbomify.com/CVE-2019-1032/): Microsoft Office SharePoint XSS Vulnerability (medium 5.4)
- [CVE-2019-10319](https://insights.sbomify.com/CVE-2019-10319/): Missing authorization in Jenkins PAM Authentication Plugin (medium 4.3)
- [CVE-2019-10318](https://insights.sbomify.com/CVE-2019-10318/): Jenkins Azure AD Plugin stored the client secret unencrypted (high 8.8)
- [CVE-2019-10317](https://insights.sbomify.com/CVE-2019-10317/): Jenkins SiteMonitor Plugin globally and unconditionally disables SSL/TLS certificate validation (medium 5.9)
- [CVE-2019-10316](https://insights.sbomify.com/CVE-2019-10316/): Jenkins Aqua MicroScanner Plugin stored credentials in plain text (high 8.8)
- [CVE-2019-10315](https://insights.sbomify.com/CVE-2019-10315/): Jenkins GitHub Authentication Plugin Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2019-10314](https://insights.sbomify.com/CVE-2019-10314/): Jenkins Koji Plugin globally and unconditionally disables SSL/TLS certificate validation (medium 5.9)
- [CVE-2019-10313](https://insights.sbomify.com/CVE-2019-10313/): Jenkins Twitter Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10312](https://insights.sbomify.com/CVE-2019-10312/): Missing permission check in Jenkins Ansible Tower Plugin (medium 4.3)
- [CVE-2019-10311](https://insights.sbomify.com/CVE-2019-10311/): Jenkins Ansible Tower Plugin missing permission check (high 8.8)
- [CVE-2019-10310](https://insights.sbomify.com/CVE-2019-10310/): Jenkins Ansible Tower Plugin cross-site request forgery vulnerability (high 8.8)
- [CVE-2019-1031](https://insights.sbomify.com/CVE-2019-1031/): Microsoft Office SharePoint XSS Vulnerability (medium 5.4)
- [CVE-2019-10309](https://insights.sbomify.com/CVE-2019-10309/): Jenkins Self-Organizing Swarm Plug-in Modules Plugin XXE vulnerability via UDP broadcast response (critical 9.3)
- [CVE-2019-10308](https://insights.sbomify.com/CVE-2019-10308/): Missing permission check in Jenkins Static Analysis Utilities Plugin (medium 6.5)
- [CVE-2019-10307](https://insights.sbomify.com/CVE-2019-10307/): Jenkins Static Analysis Utilities Plugin is vulnerable to Cross-site request forgery vulnerability (medium 6.5)
- [CVE-2019-10306](https://insights.sbomify.com/CVE-2019-10306/): Sandbox bypass in ontrack Jenkins Plugin (critical 9.9)
- [CVE-2019-10305](https://insights.sbomify.com/CVE-2019-10305/): Missing permission check in Jenkins XebiaLabs XL Deploy Plugin (medium 6.5)
- [CVE-2019-10304](https://insights.sbomify.com/CVE-2019-10304/): Jenkins XebiaLabs XL Deploy Plugin vulnerable to Cross-site request forgery (CSRF) (medium 6.5)
- [CVE-2019-10303](https://insights.sbomify.com/CVE-2019-10303/): Jenkins Azure PublisherSettings Credentials Plugin stored credentials in plain text (high 8.8)
- [CVE-2019-10302](https://insights.sbomify.com/CVE-2019-10302/): Jenkins jira-ext Plugin stores credentials unencrypted (high 8.8)
- [CVE-2019-10301](https://insights.sbomify.com/CVE-2019-10301/): Jenkins GitLab Plugin missing permission checks (high 8.8)
- [CVE-2019-10300](https://insights.sbomify.com/CVE-2019-10300/): Jenkins GitLab Plugin Cross-Site Request Forgery vulnerability (high 8.0)
- [CVE-2019-1030](https://insights.sbomify.com/CVE-2019-1030/): Microsoft Edge based on Edge HTML Information Disclosure Vulnerability (medium 4.3)
- [CVE-2019-10299](https://insights.sbomify.com/CVE-2019-10299/): Jenkins CloudCoreo DeployTime Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10298](https://insights.sbomify.com/CVE-2019-10298/): Jenkins Koji Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10297](https://insights.sbomify.com/CVE-2019-10297/): Jenkins Sametime Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10296](https://insights.sbomify.com/CVE-2019-10296/): Jenkins Serena SRA Deploy Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10295](https://insights.sbomify.com/CVE-2019-10295/): Jenkins crittercism-dsym Plugin stores API key in plain text (high 8.8)
- [CVE-2019-10294](https://insights.sbomify.com/CVE-2019-10294/): Jenkins Kmap Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10293](https://insights.sbomify.com/CVE-2019-10293/): Missing permission check in Jenkins Kmap Plugin allow SSRF (medium 6.5)
- [CVE-2019-10292](https://insights.sbomify.com/CVE-2019-10292/): CSRF vulnerability in Jenkins Nomad Plugin allow SSRF (medium 6.5)
- [CVE-2019-10291](https://insights.sbomify.com/CVE-2019-10291/): Jenkins Netsparker Enterprise Scan Plugin stored credentials in plain text (high 8.8)
- [CVE-2019-10290](https://insights.sbomify.com/CVE-2019-10290/): Missing permission check in Jenkins Netsparker Cloud Scan Plugin (medium 6.5)
- [CVE-2019-1029](https://insights.sbomify.com/CVE-2019-1029/): Skype for Business and Lync Server Denial of Service Vulnerability (medium 5.9)
- [CVE-2019-10289](https://insights.sbomify.com/CVE-2019-10289/): CSRF vulnerability in Jenkins Netsparker Enterprise Scan Plugin (medium 6.5)
- [CVE-2019-10288](https://insights.sbomify.com/CVE-2019-10288/): Jenkins Jabber Server Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10287](https://insights.sbomify.com/CVE-2019-10287/): Jenkins youtrack-plugin Plugin stored credentials in plain text (high 8.8)
- [CVE-2019-10286](https://insights.sbomify.com/CVE-2019-10286/): Jenkins DeployHub Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10285](https://insights.sbomify.com/CVE-2019-10285/): Jenkins Minio Storage Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10284](https://insights.sbomify.com/CVE-2019-10284/): Jenkins Diawi Upload Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10283](https://insights.sbomify.com/CVE-2019-10283/): Jenkins mabl Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-10282](https://insights.sbomify.com/CVE-2019-10282/): Jenkins Klaros-Testmanagement Plugin stores credentials in plain text (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/150/