23 matches found
CVE-2026-92132
Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...
CVE-2026-92132
Jenkins Gradle Plugin versions 2.19.1252.v15196b_5a_6e10 and earlier are vulnerable to an SSRF attack. When a Develocity server URL is configured in the global configuration, the plugin's enriched build scan summary should request data from that configured URL. Instead, it requests data from the ...
CVE-2026-92132
Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...
CVE-2026-92132
Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...
EUVD-2026-80756
Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...
CVE-2026-92132: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...
SSRF vulnerability in gradle allows capturing the Develocity access key
gradle provides global options for administrators to detect build scan links in build logs, and to show an enriched build scan summary for those build scans on the build page. In gradle 2.19.1252.v15196b5a6e10 and earlier, the enriched build scan summary requests data from the build scan link...
EUVD-2024-42218
Malicious code in bioql PyPI...
EUVD-2025-3961
Malicious code in bioql PyPI...
CVE-2025-24858
Develocity formerly Gradle Enterprise before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection...
CVE-2024-46881
Develocity formerly Gradle Enterprise before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functionality from schema version 8 to versions 9 and 10 in affected vulnerable versions does not include...
CVE-2024-46881
Develocity formerly Gradle Enterprise before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functionality from schema version 8 to versions 9 and 10 in affected vulnerable versions does not include...
CVE-2025-24858
Develocity formerly Gradle Enterprise before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection...
Gradle 安全漏洞
Gradle is a set of JVM-based project building tools from Gradle, Inc. that supports maven, Ivy repositories, and more. A security vulnerability exists in Gradle Develocity versions prior to 2024.3.1, which stems from a vulnerability that allows an attacker with network access privileges to obtain...
PT-2025-2749 · Unknown · Develocity
Name of the Vulnerable Software and Affected Versions: Develocity versions 2023.3.X through 2023.4.X Develocity versions 2023.3.X through 2024.1.7 Develocity versions 2023.4.X through 2024.1.7 Develocity versions prior to 2024.1.8 Description: The issue arises from incorrect access control in...
PT-2025-5588 · Unknown · Develocity
Name of the Vulnerable Software and Affected Versions: Develocity versions prior to 2024.3.1 Description: The issue allows an attacker with network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used provides some protection against brute-force...
CVE-2025-24858
Develocity formerly Gradle Enterprise before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection...
CVE-2025-24858
CVE-2025-24858 affects Develocity (formerly Gradle Enterprise) versions prior to 2024.3.1. A network-adjacent attacker can obtain the hashed system-user password from a Develocity server. The hash method is stated to follow password-storage best practices but remains vulnerable to offline attempt...
CVE-2024-46881
Develocity formerly Gradle Enterprise before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functionality from schema version 8 to versions 9 and 10 in affected vulnerable versions does not include...
CVE-2024-46881
Develocity formerly Gradle Enterprise before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functionality from schema version 8 to versions 9 and 10 in affected vulnerable versions does not include...