com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +37 more potentially affected by CVE-2024-23899 via org.jenkins-ci.plugins:git-server (1.5)

org.jenkins-ci.plugins:git-server MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-server and may be impacted: - com.btc.ep:btc-embeddedplatform =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2,...

io.jenkins.blueocean:blueocean (1.1.0-beta-1), io.jenkins.blueocean:blueocean-events (1.1.0-beta-1) +4 more potentially affected by CVE-2024-23900 via org.jenkins-ci.plugins:matrix-project (1.9)

org.jenkins-ci.plugins:matrix-project MAVEN version 1.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-project and may be impacted: - io.jenkins.blueocean:blueocean 1.1.0-beta-1 - io.jenkins.blueocean:blueocean-events...

com.coravy.hudson.plugins.github:github (>=1.28.0, <=1.29.4), io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45) +51 more potentially affected by CVE-2024-23900 via org.jenkins-ci.plugins:matrix-project (1.7.1)

org.jenkins-ci.plugins:matrix-project MAVEN version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:matrix-project and may be impacted: - com.coravy.hudson.plugins.github:github =1.28.0, =y, =1.0.0-b12, =1.0.0-b13,...

com.barchart.jenkins:maven-release-cascade (>=1.0.0, <=1.0.2), com.base2services.jenkins:github-sqs-plugin (>=1.0, <=1.5) +26 more potentially affected by CVE-2023-46650 via com.coravy.hudson.plugins.github:github (>=1.2, <=1.29.3)

com.coravy.hudson.plugins.github:github MAVEN version =1.2, =1.0.0, =1.0, =4.0.9, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =1.0.0-b15, =1.0.0-b15, =1.0-alpha-8, =1.0-alpha-4, =0.1-preview-4, =1.0-alpha-1, =1.3.0-alpha.1, =1.0, =0.9.14, =4.0.8 and more Source cves: CVE-2023-46650 Source advisory:...

CVE-2023-40341

A flaw was found in the blueocean Jenkins plugin. Affected versions of this plugin allow attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (>=0.6, <=0.7), io.jenkins.blueocean:blueocean (>=1.0.0-b22, <=1.0.0-b24) +12 more potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (5.17)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin =0.6, =1.0.0-b22...

CSRF vulnerability in blueocean allows capturing credentials

blueocean 1.27.5 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job. This...

io.jenkins.blueocean:blueocean-pipeline-scm-api (>=1.27.4, <=1.27.5.1), io.jenkins.plugins:code-coverage-api (>=4.5.0, <=4.7.0) +2 more potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (1282.ve6d865025906)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 1282.ve6d865025906 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - io.jenkins.blueocean:blueocean-pipeline-scm-api =1.27.4,...

io.jenkins.blueocean:blueocean (>=1.0-alpha-1, <=1.0-alpha-2), io.jenkins.blueocean:blueocean-dashboard (>=1.0-alpha-1, <=1.0-alpha-2) +2 more potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (2.2-beta-1)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 2.2-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - io.jenkins.blueocean:blueocean =1.0-alpha-1, =1.0-alpha-1,...

io.jenkins.blueocean:blueocean (>=1.0-alpha-3, <=1.0.0-b03), io.jenkins.blueocean:blueocean-dashboard (>=1.0-alpha-3, <=1.0.0-b03) +5 more potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (2.3)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - io.jenkins.blueocean:blueocean =1.0-alpha-3, =1.0-alpha-3, =1.0-alpha-3,...

io.jenkins.blueocean:blueocean (1.2.0-beta-1), io.jenkins.blueocean:blueocean-events (1.2.0-beta-1) +10 more potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (2.11)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 2.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - io.jenkins.blueocean:blueocean 1.2.0-beta-1 -...

io.jenkins.blueocean:blueocean-git-pipeline (>=1.2.0-beta-3, <=1.2.4), io.jenkins.blueocean:blueocean-pipeline-scm-api (>=1.2.0-beta-3, <=1.3.6) +1 more potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (2.11.1)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 2.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - io.jenkins.blueocean:blueocean-git-pipeline =1.2.0-beta-3,...

com.arkea.satd:xlrelease-var-setter (>=0.2, <=0.4), io.jenkins.blueocean:blueocean (>=1.0.0-b02, <=1.0.0-b12) +3 more potentially affected by CVE-2023-24422 via org.jenkins-ci.plugins:script-security (1.22)

org.jenkins-ci.plugins:script-security MAVEN version 1.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.arkea.satd:xlrelease-var-setter =0.2, =1.0.0-b02, =1.2.1, =2.0, =0.1, =0.5 Sourc...

io.jenkins.blueocean:blueocean (>=1.0.0-b25, <=1.1.7), io.jenkins.blueocean:blueocean-dashboard (>=1.0.0-b25, <=1.0.1) +25 more potentially affected by CVE-2023-24422 via org.jenkins-ci.plugins:script-security (1.26)

org.jenkins-ci.plugins:script-security MAVEN version 1.26 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b25, =1.0.0-b25, =1.0.0-b25, =1.0.0-b25,...

io.jenkins.blueocean:blueocean-config (>=1.2.0-beta-5, <=1.2.4), io.jenkins.blueocean:blueocean-git-pipeline (>=1.2.0-beta-5, <=1.2.4) +6 more potentially affected by CVE-2022-45380 via org.jenkins-ci.plugins:junit (1.21)

org.jenkins-ci.plugins:junit MAVEN version 1.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - io.jenkins.blueocean:blueocean-config =1.2.0-beta-5, =1.2.0-beta-5, =1.2.0-beta-5, =bn, =1.3.0, =1.179,...

io.jenkins.blueocean:blueocean (>=1.1.6, <=1.1.7), io.jenkins.blueocean:blueocean-events (>=1.1.6, <=1.1.7) +6 more potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.8)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - io.jenkins.blueocean:blueocean =1.1.6, =1.1.6, =1.1.6, =1.1.6, =2.0.0, =1.7,...

de.taimos:pipeline-aws (>=1.14, <=1.20), de.taimos:pipeline-deploymon (1.0) +9 more potentially affected by CVE-2022-43409 via org.jenkins-ci.plugins.workflow:workflow-support (2.11)

org.jenkins-ci.plugins.workflow:workflow-support MAVEN version 2.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-support and may be impacted: - de.taimos:pipeline-aws =1.14, =0.1-preview-1, =2.24, =1.10, =1.3...

io.jenkins.blueocean:blueocean (>=1.0-alpha-1, <=1.0-alpha-2), io.jenkins.blueocean:blueocean-dashboard (>=1.0-alpha-1, <=1.0-alpha-2) +6 more potentially affected by CVE-2022-43409 via org.jenkins-ci.plugins.workflow:workflow-support (2.0)

org.jenkins-ci.plugins.workflow:workflow-support MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-support and may be impacted: - io.jenkins.blueocean:blueocean =1.0-alpha-1, =1.0-alpha-1,...

io.jenkins.blueocean:blueocean (>=1.0.0-b25, <=1.0.1), io.jenkins.blueocean:blueocean-dashboard (>=1.0.0-b25, <=1.0.1) +15 more potentially affected by CVE-2022-43409 via org.jenkins-ci.plugins.workflow:workflow-support (2.13)

org.jenkins-ci.plugins.workflow:workflow-support MAVEN version 2.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-support and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b25, =1.0.0-b25, =1.0.0-b2...

org.jenkins-ci.plugins.workflow:workflow-multibranch (>=2.4, <=2.8), org.jenkins-ci.plugins:blueocean-display-url (>=1.1, <=2.2.0) potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins.workflow:workflow-cps (2.3)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-multibranch =2.4, =1.1, =2.2.0...