CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10358
https://notcve.org/view.php?id=CVE-2019-10358
Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log. El Plugin Maven Integration de Jenkins versión 3.3 y anteriores, no aplicaban decoradores de registro de compilación a las compilaciones de módulos, lo que potencialmente revelaba variables de compilación confidenciales en el registro de compilación. • http://www.openwall.com/lists/oss-security/2019/07/31/1 https://jenkins.io/security/advisory/2019-07-31/#SECURITY-713 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-9843
https://notcve.org/view.php?id=CVE-2019-9843
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file. En DiffPlug Spotless en versiones anteriores a 1.20.0 (library and Maven plugin) y anteriores a 3.20.0 (Gradle plugin), el analizador XML resolvería las entidades externas a través de HTTP y HTTPS y no respetaría la configuración de resolución de entidades externas. Por ejemplo, esto permite la divulgación del contenido del archivo a un atacante MITM si una víctima realiza una operación spotlessApply en un archivo XML que no es de confianza. • https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#version-3200---march-11th-2018-javadoc-jcenter https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#version-1200---march-14th-2018-javadoc-jcenter https://github.com/diffplug/spotless/issues/358 https://github.com/diffplug/spotless/pull/369 https://lists.apache.org/thread.html/r7406e297228c42deeecdd12a576e39d63073faebf14b027b7608fdfd%40%3Cissues.iceberg.apache.org%3E • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000397
https://notcve.org/view.php?id=CVE-2017-1000397
Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dependency on commons-httpclient. El plugin Jenkins Maven 2.73.1 y anteriores y 2.17 y anteriores incluía una versión de la biblioteca commons-httpclient con la vulnerabilidad CVE-2012-6153 que verificaba incorrectamente los certificados SSL, volviéndolo susceptible a ataques de Man-in-the-Middle (MitM). El plugin Maven 3.0 ya no depende de commons-httpclient. • https://jenkins.io/security/advisory/2017-10-11 • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2013-0253 – maven-wagon: all SSL certificate checking is disabled by default
https://notcve.org/view.php?id=CVE-2013-0253
The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack. La configuración por defecto de Apache Maven v3.0.4, cuando se usa Maven Wagon v2.1 deshabilita los controles de certificado SSL, lo que permite a atacantes remotos suplantar a servidoresa través de ataques Man-in-the-middle (MITM). • http://rhn.redhat.com/errata/RHSA-2013-0700.html https://bugzilla.redhat.com/show_bug.cgi?id=917084 https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E https://maven.apache.org/security.html https://access.redhat.com/security/cve/CVE-2013-0253 • CWE-16: Configuration •