First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2019-10412

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Inedo ProGet Plugin	1.2 and earlier

References

http://www.openwall.com/lists/oss-security/2019/09/25/3Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1514Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/09/25/3Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1514Vendor Advisory

Timeline

Published: Sep 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-104136.5Jenkins Data Theorem: CI/CD Plugin 1.3 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they c CVE-2019-104146.5Jenkins Git Changelog Plugin 2.17 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could CVE-2019-104156.5Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins CVE-2019-104166.5Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master wh CVE-2019-104179.9Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke a CVE-2019-104189.9Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke a CVE-2019-104195.5Jenkins vFabric Application Director Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they CVE-2019-104205.5Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by us CVE-2019-104214.3Jenkins Azure Event Grid Build Notifier Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can b CVE-2019-104226.5Jenkins Call Remote Job Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by user CVE-2019-104235.5Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by us CVE-2019-104245.5Jenkins elOyente Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by us