GHSA-84H6-JF8X-FF2J Jenkins Bitbucket OAuth Plugin contains Insufficiently Protected Credentials

Jenkins Bitbucket OAuth Plugin prior to 0.10 stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

The vulnerability of the Hazelcast platform, a software product for data processing, in the Atlassian Bitbucket Data Center allows a perpetrator to execute arbitrary code.

The vulnerability of the Hazelcast platform, a software product for data processing, in the Atlassian/Bitbucket Data Center environment, relates to the restoration of unreliable data in memory. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code...

Jenkins Bitbucket Approve Plugin stores credentials in plain text

Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.bitbucketapprove.BitbucketApprover.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

GHSA-4CXR-4VWC-6PG7 Jenkins Bitbucket Approve Plugin stores credentials in plain text

Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.bitbucketapprove.BitbucketApprover.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

Exploit for Deserialization of Untrusted Data in Atlassian Bitbucket_Data_Center

CVE-2022-26133 Description Atlassian Bitbucket Data Cent...

PT-2022-7196

Name of the Vulnerable Software and Affected Versions com.google.code.gson:gson versions prior to 2.8.9 Bitbucket Data Center and Server versions 7.17.0, 7.21.0, 8.7.0, 8.8.0, 8.9.0, 8.10.0, 8.11.0, and 8.12.0 Description The issue is related to the deserialization mechanism in the Gson library,...

Command Execution Vulnerability in Atlassian Bitbucket Data Center

Atlassian Bitbucket Data Center is the data center version of Atlassian Bitbucket by Atlassian Australia. Atlassian Bitbucket Data Center suffers from a command execution vulnerability that can be exploited by an attacker to execute arbitrary code via Java deserialization...

CVE-2022-26133

creationtimestamp| type| source ---|---|--- 2022-04-20 22:25:54+00:00| seen| https://t.me/cibsecurity/41196 2022-05-09 12:12:21+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/2129 2022-05-12 11:01:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/5989...

CVE-2022-26133

SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java...

CVE-2022-26133

SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java...

Deserialization of untrusted data

SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java...

CVE-2022-26133

SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java...

CVE-2022-26133

CVE-2022-26133 affects Atlassian Bitbucket Data Center via SharedSecretClusterAuthenticator. A remote, unauthenticated attacker can execute arbitrary code through Java deserialization. Vulnerable versions include: 5.14.0 and later before 7.6.14; 7.7.0 and later before 7.17.6; 7.18.0 and later bef...

CVE-2022-26133: Deserialization of Untrusted Data

SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java...

Atlassian Bitbucket Data Center 代码问题漏洞

Atlassian Bitbucket Data Center is the data center version of Atlassian Bitbucket by Atlassian Australia. Atlassian Bitbucket Data Center suffers from a command execution vulnerability that can be exploited by an attacker to execute arbitrary code via Java deserialization...

Jenkins Bitbucket Server Integration Plugin授权问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application software.Jenkins Bitbucket Server...

Jenkins Bitbucket Server Integration Plugin跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier versions are...

GHSA-45V7-65Q8-X294 Stored XSS vulnerability in Jenkins Bitbucket Server Integration Plugin

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to create BitBucket Server consumers...

Stored XSS vulnerability in Jenkins Bitbucket Server Integration Plugin

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to create BitBucket Server consumers...

GHSA-R5R6-V8QH-PMPQ Missing permission checks in Jekins Bitbucket Server Integration Plugin

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to create, view, and delete BitBucket Server consumers...