com.gerritforge:events-broker (>=3.0.0, <=3.8.0-rc5), com.gerritforge:global-refdb (>=0.1.1, <=3.8.1) potentially affected by CVE-2026-87722 via com.google.gerrit:gerrit-plugin-api (>=3.0.2, <=3.8.1)

com.google.gerrit:gerrit-plugin-api MAVEN version =3.0.2, =3.0.0, =0.1.1, =3.8.1 Source cves: CVE-2026-87722 Source advisory: MEND:CVE-2026-87722...

com.gerritforge:events-broker (>=3.0.0, <=3.8.0-rc5), com.gerritforge:global-refdb (>=0.1.1, <=3.8.1) potentially affected by CVE-2026-87721 via com.google.gerrit:gerrit-plugin-api (>=3.0.2, <=3.8.1)

com.google.gerrit:gerrit-plugin-api MAVEN version =3.0.2, =3.0.0, =0.1.1, =3.8.1 Source cves: CVE-2026-87721 Source advisory: MEND:CVE-2026-87721...

com.gerritforge:events-broker (>=3.0.0, <=3.8.0-rc5), com.gerritforge:global-refdb (>=0.1.1, <=3.8.1) potentially affected by CVE-2026-87720 via com.google.gerrit:gerrit-plugin-api (>=3.0.2, <=3.8.1)

com.google.gerrit:gerrit-plugin-api MAVEN version =3.0.2, =3.0.0, =0.1.1, =3.8.1 Source cves: CVE-2026-87720 Source advisory: MEND:CVE-2026-87720...

EUVD-2022-7681

Malicious code in bioql PyPI...

CVE-2022-46688

A cross-site request forgery CSRF vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers previously configured by Jenkins administrators using attacker-specified credentials IDs obtained through another method,...

CVE-2018-1000106

An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to modify the Gerrit configuration in Jenkins...

Jenkins plugins Multiple Vulnerabilities (2022-12-07)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. CVE-2022-46682 - Jenki...

Jenkins Sonar Gerrit Plugin Cross-Site Request Forgery Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2022-46688

A cross-site request forgery CSRF vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers previously configured by Jenkins administrators using attacker-specified credentials IDs obtained through another method,...

CVE-2022-46688: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers previously configured by Jenkins administrators using attacker-specified credentials IDs obtained through another method,...

CVE-2022-46688

A cross-site request forgery CSRF vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers previously configured by Jenkins administrators using attacker-specified credentials IDs obtained through another method,...

PT-2022-27952 · Jenkins · Jenkins Sonar Gerrit Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Sonar Gerrit Plugin versions 377.v8f3808963dc5 and earlier Description: A cross-site request forgery CSRF issue allows attackers to have Jenkins connect to Gerrit servers using attacker-specified credentials IDs, potentially capturing...

CVE-2022-46688

A cross-site request forgery CSRF vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers previously configured by Jenkins administrators using attacker-specified credentials IDs obtained through another method,...

com.bluetrainsoftware.gerrit:slack-notifier (1.1) potentially affected by CVE-2020-8920 via com.google.gerrit:gerrit-plugin-api (2.9.1)

com.google.gerrit:gerrit-plugin-api MAVEN version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.gerrit:gerrit-plugin-api and may be impacted: - com.bluetrainsoftware.gerrit:slack-notifier 1.1 Source cves: CVE-2020-8920 Source advisor...

com.bluetrainsoftware.gerrit:slack-notifier (1.1) potentially affected by CVE-2020-8920 via com.google.gerrit:gerrit-plugin-api (2.9.1)

com.google.gerrit:gerrit-plugin-api MAVEN version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.gerrit:gerrit-plugin-api and may be impacted: - com.bluetrainsoftware.gerrit:slack-notifier 1.1 Source cves: CVE-2020-8920 Source advisor...

com.gerritforge:events-broker (>=3.0.0, <=3.0.5), com.gerritforge:global-refdb (>=0.1.1, <=3.0.2) potentially affected by CVE-2020-8920 via com.google.gerrit:gerrit-plugin-api (3.0.2)

com.google.gerrit:gerrit-plugin-api MAVEN version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.gerrit:gerrit-plugin-api and may be impacted: - com.gerritforge:events-broker =3.0.0, =0.1.1, =3.0.2 Source cves: CVE-2020-8920 Source...

com.gerritforge:events-broker (>=3.0.0, <=3.0.5), com.gerritforge:global-refdb (>=0.1.1, <=3.0.2) potentially affected by CVE-2020-8920 via com.google.gerrit:gerrit-plugin-api (3.0.2)

com.google.gerrit:gerrit-plugin-api MAVEN version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.gerrit:gerrit-plugin-api and may be impacted: - com.gerritforge:events-broker =3.0.0, =0.1.1, =3.0.2 Source cves: CVE-2020-8920 Source...

com.gerritforge:global-refdb (3.2.3) potentially affected by CVE-2020-8920 via com.google.gerrit:gerrit-plugin-api (3.2.3)

com.google.gerrit:gerrit-plugin-api MAVEN version 3.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.gerrit:gerrit-plugin-api and may be impacted: - com.gerritforge:global-refdb 3.2.3 Source cves: CVE-2020-8920 Source advisory:...

com.gerritforge:global-refdb (3.2.3) potentially affected by CVE-2020-8920 via com.google.gerrit:gerrit-plugin-api (3.2.3)

com.google.gerrit:gerrit-plugin-api MAVEN version 3.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.gerrit:gerrit-plugin-api and may be impacted: - com.gerritforge:global-refdb 3.2.3 Source cves: CVE-2020-8920 Source advisory:...

Jenkins Sonar Gerrit Plugin stores credentials unencrypted

Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...