# Vulnerabilities published in 2019


- [CVE-2019-1004](https://insights.sbomify.com/CVE-2019-1004/): Memory corruption in Internet Explorer 10 (high 7.5)
- [CVE-2019-10039](https://insights.sbomify.com/CVE-2019-10039/): Auth bypass in dlink:dir-816 firmware (critical 9.8)
- [CVE-2019-10038](https://insights.sbomify.com/CVE-2019-10038/): Path traversal in evernote:evernote (high 7.8)
- [CVE-2019-1003099](https://insights.sbomify.com/CVE-2019-1003099/): Jenkins openid Plugin missing permission check (medium 6.5)
- [CVE-2019-1003098](https://insights.sbomify.com/CVE-2019-1003098/): Jenkins OpenID Plugin CSRF vulnerability (medium 6.5)
- [CVE-2019-1003097](https://insights.sbomify.com/CVE-2019-1003097/): Jenkins Crowd Integration Plugin stores credentials in plain text (medium 6.5)
- [CVE-2019-1003096](https://insights.sbomify.com/CVE-2019-1003096/): Jenkins TestFairy Plugin stores credentials in plain text (medium 6.5)
- [CVE-2019-1003095](https://insights.sbomify.com/CVE-2019-1003095/): Jenkins Perfecto Mobile Plugin stores credentials in plain text (medium 6.5)
- [CVE-2019-1003094](https://insights.sbomify.com/CVE-2019-1003094/): Jenkins Open STF Plugin stores credentials in plain text (medium 6.5)
- [CVE-2019-1003093](https://insights.sbomify.com/CVE-2019-1003093/): Jenkins Nomad Plugin missing permission check (medium 6.5)
- [CVE-2019-1003092](https://insights.sbomify.com/CVE-2019-1003092/): Cross-site request forgery vulnerability in Jenkins Nomad Plugin (medium 6.5)
- [CVE-2019-1003091](https://insights.sbomify.com/CVE-2019-1003091/): Missing permission check in Jenkins SOASTA CloudTest Plugin (medium 6.5)
- [CVE-2019-1003090](https://insights.sbomify.com/CVE-2019-1003090/): CSRF vulnerability in Jenkins SOASTA CloudTest Plugin (medium 6.5)
- [CVE-2019-1003089](https://insights.sbomify.com/CVE-2019-1003089/): Jenkins Upload to pgyer Plugin stores credentials in plain text (medium 6.5)
- [CVE-2019-1003088](https://insights.sbomify.com/CVE-2019-1003088/): Jenkins Fabric-beta-publisher Plugin stores credentials in plain text (medium 6.5)
- [CVE-2019-1003087](https://insights.sbomify.com/CVE-2019-1003087/): Missing permission check in Jenkins sinatra-chef-builder Plugin (medium 6.5)
- [CVE-2019-1003086](https://insights.sbomify.com/CVE-2019-1003086/): CSRF vulnerability in Jenkins sinatra-chef-builder Plugin (medium 6.5)
- [CVE-2019-1003085](https://insights.sbomify.com/CVE-2019-1003085/): Jenkins Zephyr Enterprise Test Management Plugin missing permission check (medium 6.5)
- [CVE-2019-1003084](https://insights.sbomify.com/CVE-2019-1003084/): CSRF vulnerability in Zephyr Enterprise Test Management Plugin (medium 6.5)
- [CVE-2019-1003083](https://insights.sbomify.com/CVE-2019-1003083/): Missing permission check in Jenkins Gearman Plugin (medium 6.5)
- [CVE-2019-1003082](https://insights.sbomify.com/CVE-2019-1003082/): CSRF vulnerability in Jenkins Gearman Plugin (medium 6.5)
- [CVE-2019-1003081](https://insights.sbomify.com/CVE-2019-1003081/): CSRF vulnerability in Jenkins OpenShift Deployer Plugin (medium 6.5)
- [CVE-2019-1003080](https://insights.sbomify.com/CVE-2019-1003080/): CSRF vulnerability in Jenkins OpenShift Deployer Plugin (medium 6.5)
- [CVE-2019-1003079](https://insights.sbomify.com/CVE-2019-1003079/): Missing permission check in Jenkins VMware Lab Manager Slaves Plugin (medium 6.5)
- [CVE-2019-1003078](https://insights.sbomify.com/CVE-2019-1003078/): Jenkins VMware Lab Manager Slaves Plugin vulnerable CSRF vulnerability (medium 6.5)
- [CVE-2019-1003077](https://insights.sbomify.com/CVE-2019-1003077/): Missing permission check in Jenkins Audit to Database Plugin (medium 6.5)
- [CVE-2019-1003076](https://insights.sbomify.com/CVE-2019-1003076/): CSRF vulnerability in Jenkins Audit to Database Plugin (medium 6.5)
- [CVE-2019-1003075](https://insights.sbomify.com/CVE-2019-1003075/): Jenkins Audit to Database Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003074](https://insights.sbomify.com/CVE-2019-1003074/): Jenkins hyper.sh Commons Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003073](https://insights.sbomify.com/CVE-2019-1003073/): Jenkins VS Team Services Continuous Deployment Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003072](https://insights.sbomify.com/CVE-2019-1003072/): Jenkins wildFly Deployer Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003071](https://insights.sbomify.com/CVE-2019-1003071/): Jenkins Octopus Deploy Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003070](https://insights.sbomify.com/CVE-2019-1003070/): Jenkins veracode-scanner Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003069](https://insights.sbomify.com/CVE-2019-1003069/): Jenkins Aqua Security Scanner Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003068](https://insights.sbomify.com/CVE-2019-1003068/): Jenkins VMware vRealize Automation Plugin Missing Encryption of Sensitive Data (high 8.8)
- [CVE-2019-1003067](https://insights.sbomify.com/CVE-2019-1003067/): Jenkins Trac Publisher Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003066](https://insights.sbomify.com/CVE-2019-1003066/): Jenkins Bugzilla Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003065](https://insights.sbomify.com/CVE-2019-1003065/): Jenkins CloudShare Docker-Machine Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003064](https://insights.sbomify.com/CVE-2019-1003064/): Jenkins aws-device-farm Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003063](https://insights.sbomify.com/CVE-2019-1003063/): Jenkins Amazon SNS Build Notifier Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003062](https://insights.sbomify.com/CVE-2019-1003062/): Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003061](https://insights.sbomify.com/CVE-2019-1003061/): Jenkins CloudFormation Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003060](https://insights.sbomify.com/CVE-2019-1003060/): Jenkins OWASP ZAP Plugin stores unencrypted credentials (high 8.8)
- [CVE-2019-1003059](https://insights.sbomify.com/CVE-2019-1003059/): Missing permission check in Jenkins FTP publisher Plugin (medium 6.5)
- [CVE-2019-1003058](https://insights.sbomify.com/CVE-2019-1003058/): CSRF vulnerability in Jenkins FTP publisher Plugin (medium 6.5)
- [CVE-2019-1003057](https://insights.sbomify.com/CVE-2019-1003057/): Jenkins Bitbucket Approve Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003056](https://insights.sbomify.com/CVE-2019-1003056/): Jenkins WebSphere Deployer Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003055](https://insights.sbomify.com/CVE-2019-1003055/): Jenkins FTP publisher Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003054](https://insights.sbomify.com/CVE-2019-1003054/): Jenkins Jira Issue Updater Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003053](https://insights.sbomify.com/CVE-2019-1003053/): Jenkins HockeyApp Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003052](https://insights.sbomify.com/CVE-2019-1003052/): Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003051](https://insights.sbomify.com/CVE-2019-1003051/): Jenkins IRC Plugin stores credentials in plain text (high 8.8)
- [CVE-2019-1003050](https://insights.sbomify.com/CVE-2019-1003050/): Improper Neutralization of Input During Web Page Generation in Jenkins (medium 5.4)
- [CVE-2019-1003049](https://insights.sbomify.com/CVE-2019-1003049/): Insufficient Session Expiration in Jenkins (high 8.1)
- [CVE-2019-1003048](https://insights.sbomify.com/CVE-2019-1003048/): Jenkins PRQA Plugin stored password in plain text (high 7.8)
- [CVE-2019-1003047](https://insights.sbomify.com/CVE-2019-1003047/): SSRF vulnerability due to missing permission check in Fortify on Demand Uploader Plugin (medium 6.5)
- [CVE-2019-1003046](https://insights.sbomify.com/CVE-2019-1003046/): Jenkins Fortify on Demand Uploader Plugin CSRF vulnerability (medium 6.5)
- [CVE-2019-1003045](https://insights.sbomify.com/CVE-2019-1003045/): ECS Publisher Plugin stored and displayed API token in plain text (medium 6.5)
- [CVE-2019-1003044](https://insights.sbomify.com/CVE-2019-1003044/): Jenkins Slack Notification Plugin CSRF vulnerability and missing permission checks (high 7.1)
- [CVE-2019-1003043](https://insights.sbomify.com/CVE-2019-1003043/): Jenkins Slack Notification Plugin missing permission check (high 7.5)
- [CVE-2019-1003042](https://insights.sbomify.com/CVE-2019-1003042/): Jenkins Lockable Resources Plugin XSS vulnerability (medium 5.4)
- [CVE-2019-1003041](https://insights.sbomify.com/CVE-2019-1003041/): Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin (critical 9.8)
- [CVE-2019-1003040](https://insights.sbomify.com/CVE-2019-1003040/): Sandbox bypass vulnerability in Jenkins Script Security Plugin (critical 9.8)
- [CVE-2019-1003039](https://insights.sbomify.com/CVE-2019-1003039/): Jenkins AppDynamics Dashboard Plugin has insufficiently protected credentials (high 8.8)
- [CVE-2019-1003038](https://insights.sbomify.com/CVE-2019-1003038/): Jenkins Repository Connector Plugin has insufficiently protected credentials (high 7.8)
- [CVE-2019-1003037](https://insights.sbomify.com/CVE-2019-1003037/): Unprivileged users with Overall/Read access are able to enumerate credential IDs in Azure VM Agents Plugin (medium 6.5)
- [CVE-2019-1003036](https://insights.sbomify.com/CVE-2019-1003036/): Missing permission check in Azure VM Agents Plugin allowed modifying VM configuration (medium 4.3)
- [CVE-2019-1003035](https://insights.sbomify.com/CVE-2019-1003035/): Information disclosure in Azure VM Agents Plugin (medium 4.3)
- [CVE-2019-1003034](https://insights.sbomify.com/CVE-2019-1003034/): Script security sandbox bypass in Jenkins Job DSL Plugin (critical 9.9)
- [CVE-2019-1003033](https://insights.sbomify.com/CVE-2019-1003033/): Jenkins Groovy Plugin sandbox bypass vulnerability (high 8.8)
- [CVE-2019-1003032](https://insights.sbomify.com/CVE-2019-1003032/): Script security sandbox bypass in Jenkins Email Extension Plugin (critical 9.9)
- [CVE-2019-1003031](https://insights.sbomify.com/CVE-2019-1003031/): Script security sandbox bypass in Matrix Project Plugin (critical 9.9)
- [CVE-2019-1003030](https://insights.sbomify.com/CVE-2019-1003030/): Jenkins Matrix Project Plugin Remote Code Execution (critical 9.9, exploited in the wild)
- [CVE-2019-1003029](https://insights.sbomify.com/CVE-2019-1003029/): Jenkins Script Security Plugin Sandbox Bypass (critical 9.9, exploited in the wild)
- [CVE-2019-1003028](https://insights.sbomify.com/CVE-2019-1003028/): SSRF vulnerability due to missing permission check in Jenkins JMS Messaging Plugin (medium 4.3)
- [CVE-2019-1003027](https://insights.sbomify.com/CVE-2019-1003027/): SSRF vulnerability due to missing permission check in Jenkins OctopusDeploy Plugin (medium 4.3)
- [CVE-2019-1003026](https://insights.sbomify.com/CVE-2019-1003026/): Jenkins Mattermost Notification Plugin vulnerable to SSRF (medium 4.3)
- [CVE-2019-1003025](https://insights.sbomify.com/CVE-2019-1003025/): Jenkins Cloud Foundry Plugin vulnerable to exposure of sensitive information (high 8.8)
- [CVE-2019-1003024](https://insights.sbomify.com/CVE-2019-1003024/): Jenkins Script Security Plugin sandbox bypass vulnerability (high 8.8)
- [CVE-2019-1003023](https://insights.sbomify.com/CVE-2019-1003023/): XSS vulnerability in Jenkins Warnings Next Generation Plugin (medium 6.1)
- [CVE-2019-1003022](https://insights.sbomify.com/CVE-2019-1003022/): Jenkins Monitoring Plugin vulnerable to Denial of service vulnerability (medium 6.5)
- [CVE-2019-1003021](https://insights.sbomify.com/CVE-2019-1003021/): Jenkins OpenId Connect Authentication Plugin showed plain text client secret in configuration form (medium 4.3)
- [CVE-2019-1003020](https://insights.sbomify.com/CVE-2019-1003020/): Jenkins Kanboard Plugin vulnerable to Server-side request forgery (SSRF) (medium 4.3)
- [CVE-2019-1003019](https://insights.sbomify.com/CVE-2019-1003019/): GitHub Authentication Plugin session fixation vulnerability (medium 5.9)
- [CVE-2019-1003018](https://insights.sbomify.com/CVE-2019-1003018/): GitHub Authentication Plugin showed plain text client secret in configuration form (medium 4.3)
- [CVE-2019-1003017](https://insights.sbomify.com/CVE-2019-1003017/): Jenkins Job Import Plugin CSRF vulnerability (medium 5.3)
- [CVE-2019-1003016](https://insights.sbomify.com/CVE-2019-1003016/): Jenkins Job Import Plugin vulnerable to exposure of sensitive information (high 8.8)
- [CVE-2019-1003015](https://insights.sbomify.com/CVE-2019-1003015/): XXE vulnerability in Jenkins Job Import Plugin (critical 9.1)
- [CVE-2019-1003014](https://insights.sbomify.com/CVE-2019-1003014/): Jenkins Config File Provider Plugin XSS vulnerability (medium 4.8)
- [CVE-2019-1003013](https://insights.sbomify.com/CVE-2019-1003013/): Cross-site Scripting in Jenkins Blue Ocean Plugin (medium 5.4)
- [CVE-2019-1003012](https://insights.sbomify.com/CVE-2019-1003012/): Cross-Site Request Forgery in Jenkins Blue Ocean Plugin (medium 6.5)
- [CVE-2019-1003011](https://insights.sbomify.com/CVE-2019-1003011/): Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS (high 8.1)
- [CVE-2019-1003010](https://insights.sbomify.com/CVE-2019-1003010/): Cross-Site Request Forgery in Jenkins Git Plugin (medium 4.3)
- [CVE-2019-1003009](https://insights.sbomify.com/CVE-2019-1003009/): Jenkins Active Directory Plugin Improper certificate validation with StartTLS (high 7.4)
- [CVE-2019-1003008](https://insights.sbomify.com/CVE-2019-1003008/): Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability (high 8.8)
- [CVE-2019-1003007](https://insights.sbomify.com/CVE-2019-1003007/): Sandbox Bypass via CSRF in Jenkins Warnings Plugin (high 8.8)
- [CVE-2019-1003006](https://insights.sbomify.com/CVE-2019-1003006/): Jenkins Groovy Plugin sandbox bypass vulnerability (high 8.8)
- [CVE-2019-1003005](https://insights.sbomify.com/CVE-2019-1003005/): Sandbox Bypass in Script Security Plugin (high 8.8)
- [CVE-2019-1003004](https://insights.sbomify.com/CVE-2019-1003004/): Improper Authorization in Jenkins Core (high 7.2)
- [CVE-2019-1003003](https://insights.sbomify.com/CVE-2019-1003003/): Improper Authorization in Jenkins Core (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/155/