Jenkins Plugin Security Advisory: Git Parameter RCE and Multiple Plugins Credential Exposure

Key Information Vulnerability Description Git Parameter Plugin: Lacks input validation for parameter values, potentially leading to arbitrary code execution. Aqua Security Scanner Plugin: Stores tokens in plaintext, posing a security risk. Statistics Gathering Plugin: AWS keys are unencrypted and displayed in plaintext, risking exposure. ReadyAPI Functional Testing Plugin: Credentials stored and displayed in plaintext, risking exposure. Applitools Eyes Plugin: Contains stored XSS vulnerability, potentially exploitable for cross-site scripting attacks. Qmetry Test Management Plugin: API keys stored and displayed in plaintext, risking exposure. Testigma Test Plan run Plugin: API keys displayed without masking, risking exposure. IFTTT Build Notifier Plugin: Keys stored in plaintext, posing a security risk. IBM Cloud DevOps Plugin: Tokens stored in plaintext, posing a security risk. Spice Loadtest Plugin: Tokens stored and displayed in plaintext, posing a security risk. Dead Man's Snitch Plugin: Tokens stored and displayed in plaintext, posing a security risk. Maddy Plugin: API keys stored and displayed in plaintext, posing a security risk. Novozaal OneCloud Plugin: Keys stored and displayed in plaintext, posing a security risk. Kryptonite Plugin: API keys stored in plaintext, posing a security risk. Sensedia Api Platform Plugin: Tokens stored and displayed in plaintext, posing a security risk. Warrior Framework Plugin: Passwords stored in plaintext, posing a security risk. Xoon Plugin: Tokens stored and displayed in plaintext, posing a security risk. Userlist Ufacial Plugin: Tokens stored in plaintext, posing a security risk. Severity Critical: Jenkins Git Parameter Plugin, Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReadyAPI Functional Testing Plugin, Applitools Eyes Plugin, Qmetry Test Management Plugin, Testigma Test Plan run Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spice Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novozaal OneCloud Plugin, Kryptonite Plugin, Sensedia Api Platform Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacial Plugin. Affected Versions Specific affected versions for each plugin are detailed in the official advisory. Fix Upgrade to the latest version or apply patches provided by the vendor. Acknowledgments Thank you to all security researchers and teams who reported and assisted in resolving these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Plugin Security Advisory: Git Parameter RCE and Multiple Plugins Credential Exposure