PoC_CVE-2024-28157

PoC CVE-2024-28157 Overview Jenkins GitBucket Plugin veersion 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs. Exploitation Steps Setup Jenkins using docker: 1. Use docker...

PoC_CVE-2024-28157

CVE-2024-28157 - Stored XSS in Jenkins GitBucket Plugin GitBucket URL: javascript:alert77 3. Save, then visit the project page 4. Alert fires with 49 77 Screenshots are in poc/screenshots/ References NVD https://nvd.nist.gov/vuln/detail/CVE-2024-28157...

io.github.gitbucket:gitbucket_2.13 (>=4.37.0, <=4.48.0), org.apache.sshd:apache-sshd (>=2.2.0, <=2.19.0) +2 more potentially affected by CVE-2026-94053 via org.apache.sshd:sshd-ldap (>=2.2.0, <=2.19.0)

org.apache.sshd:sshd-ldap MAVEN version =2.2.0, =4.37.0, =2.2.0, =2.0.0, =2.0.0, =2.0.1 Source cves: CVE-2026-94053 Source advisory: MEND:CVE-2026-94053...

io.github.gitbucket:gitbucket_2.13 (>=4.37.0, <=4.48.0), org.apache.sshd:apache-sshd (>=2.2.0, <=2.19.0) +2 more potentially affected by CVE-2026-94052 via org.apache.sshd:sshd-ldap (>=2.2.0, <=2.19.0)

org.apache.sshd:sshd-ldap MAVEN version =2.2.0, =4.37.0, =2.2.0, =2.0.0, =2.0.0, =2.0.1 Source cves: CVE-2026-94052 Source advisory: MEND:CVE-2026-94052...

CVE-2026-13540

A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack i...

CVE-2026-13540 GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgery

A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack i...

CVE-2026-13540 GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgery

A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack i...

CVE-2026-13540

A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack i...

EUVD-2026-40038

A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack i...

CVE-2026-13540 GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgery

A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack i...

CVE-2026-13540

GitBucket up to 4.46.1 is affected by a vulnerability in Git.cloneRepository.setURI (RepositoryCreationService.scala) that allows server-side request forgery when the argument url is manipulated. This can be exploited remotely. An exploit has been released publicly. The patch identified is 487a9b...

CVE-2026-13540: Server-Side Request Forgery (SSRF)

A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack i...

PT-2026-53215

A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack i...

org.jenkins-ci.plugins:fitnesse (>=1.12, <=1.13), org.jenkins-ci.plugins:git (>=1.4.0, <=1.5.0) +2 more potentially affected by CVE-2026-57282 via org.jenkins-ci.plugins:git-client (1.0.6)

org.jenkins-ci.plugins:git-client MAVEN version 1.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:fitnesse =1.12, =1.4.0, =1.0, =0.1, =0.4 Source cves: CVE-2026-57282...

CVE-2018-25332

GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR...

CVE-2018-25332 GitBucket 4.23.1 Unauthenticated Remote Code Execution

GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR...

CVE-2018-25332 GitBucket 4.23.1 Unauthenticated Remote Code Execution

GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR...

CVE-2018-25332

GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR...

CVE-2018-25332

CVE-2018-25332 - GitBucket 4.23.1 Unauthenticated Remote Code Execution Affected software: GitBucket 4.23.1. Vulnerability: An unauthenticated remote code execution flaw exists due to weak secret token generation and insecure file upload functionality. Adversaries can brute-force the Blowfish enc...

GitBucket access control vulnerability

GitBucket is an open-source Git code hosting platform based on Scala. Version 4.23.1 of GitBucket contains a vulnerability related to access control. This vulnerability stems from the generation of weak secret tokens and the insecure file upload feature, which may allow unauthenticated attackers ...