Jenkins Bumblebee HP Alm vulnerabilities

2 CVEs affecting Jenkins Bumblebee HP Alm, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-21614, published 2021-01-13.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-10444, published 2019-10-16. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.
• CVE-2021-21614, published 2021-01-13. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the…