60 matches found
CVE-2025-53652-Jenkins-Git-Parameter-Analysis
CVE-2025-53652: Vulnerabilidad de entrada no validada en el plugin Git Parameter de Jenkins. Resumen Esta vulnerabilidad surge porque la entrada controlada por el usuario procedente de los parámetros de build de Jenkins se inyecta de forma insegura en el comando de checkout de Git. La entrada del...
CVE-2026-84656
A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...
EUVD-2026-70122
A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...
CVE-2026-84656
A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...
CVE-2026-84656
A missing Item/Read permission check in an HTTP endpoint of Jenkins 2.579 and earlier (and LTS 2.568.2 and earlier ) allows an attacker with Item/Read permission on at least one job to read build parameter names and values of other jobs they should not have access to. This is tracked as SECURITY-...
pentest_teamcity
Pentest TeamCity using Metasploit TL;DR: Obtain passwords fromJetBrains IDE like IntelliJ or PyCharm and use those credentials inside TeamCity Continuous Integration Server in order to get meterpreter session on server and build agents using metasploit by Kacper Szurek. JetBrains Comment This is ...
CVE-2026-34597
CVE-2026-34597 affects Coolify prior to 4.0.0-beta.470. The vulnerability lies in how user-supplied build parameters for the Nixpacks build pack are handled: the install_command provided by a user is directly concatenated into a shell command string executed on the deployment host during the buil...
CVE-2026-34597 Coolify: Authenticated Host RCE
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.470, a critical Authenticated Host Remote Code Execution RCE vulnerability was discovered in Coolify. The flaw resides in the handling of user-defined build parameters for the...
CVE-2026-49374
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters...
CVE-2026-49374
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters...
CVE-2026-49374
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters...
JetBrains TeamCity < 2025.11.3 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.3. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow CVE-2026-28194 - In JetBrains TeamCity before...
PT-2026-21905
In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations...
JetBrains TeamCity 安全漏洞
JetBrains TeamCity is a set of distributed build management and continuous integration tools developed by the Czech company JetBrains. This tool offers features such as continuous unit testing, code quality analysis, and reporting on build issues. Versions of JetBrains TeamCity prior to 2025.11.3...
Jenkins 安全漏洞
Jenkins is an open-source application developed by Jenkins Project. The open-source automation server Jenkins offers hundreds of plugins to support building, deploying, and automating any project. Jenkins versions 2.55 and earlier, as well as LTS versions 2.541.1 and earlier, have security...
EUVD-2016-4741
Malware in sbrugna...
EUVD-2022-3405
Malicious code in bioql PyPI...
EUVD-2024-25303
Malicious code in bioql PyPI...
CVE-2025-53652
Jenkins Git Parameter Plugin 439.vb0e46ca14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered choices, allowing attackers with Item/Build permission to inject arbitrary values into Git parameters...