372 matches found
CVE-2021-43287: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers...
PT-2022-11811
Name of the Vulnerable Software and Affected Versions ThoughtWorks GoCD versions prior to 21.3.0 Description An issue was discovered in ThoughtWorks GoCD where an attacker with privileges to create a new pipeline on a GoCD server can abuse a command-line injection in the Git URL "Test Connection"...
PT-2022-11813
Name of the Vulnerable Software and Affected Versions ThoughtWorks GoCD versions prior to 21.3.0 Description An issue was discovered where an attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report. Recommendations For versions prior to 21.3.0, update to versio...
PT-2022-11815
Name of the Vulnerable Software and Affected Versions ThoughtWorks GoCD versions prior to 21.3.0 Description An issue was discovered in ThoughtWorks GoCD where an attacker who has compromised a GoCD agent can upload a malicious file into a directory of a GoCD server. The attacker can control the...
PT-2022-11812
Name of the Vulnerable Software and Affected Versions ThoughtWorks GoCD versions prior to 21.3.0 Description An issue was discovered in ThoughtWorks GoCD where the business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers...
PT-2022-11814
Name of the Vulnerable Software and Affected Versions ThoughtWorks GoCD versions prior to 21.3.0 Description An issue allows an attacker who has compromised a GoCD agent to upload a malicious file into an arbitrary directory of a GoCD server. However, the attacker does not control the filename...
ThoughtWorks GoCD 命令注入漏洞
ThoughtWorks GoCD is a free and open source CI/CD server from ThoughtWorks, Inc. A command injection vulnerability exists in versions of ThoughtWorks GoCD prior to 21.3.0, which can be exploited by attackers to cause arbitrary command execution...
CVE-2021-43289: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrary directory of a GoCD server, but does not control the filename...
CVE-2022-24832
GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it ca...
Authorization
GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it ca...
CVE-2022-24832 Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames
GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it ca...
CVE-2022-24832
GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it ca...
CVE-2022-24832
The CVE-2022-24832 issue affects GoCD where the bundled gocd-ldap-authentication-plugin does not properly escape special characters in LDAP usernames when constructing LDAP queries. This can enable an LDAP-authenticated GoCD user to craft and execute malicious queries to infer facts about other L...
CVE-2022-24832 Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames
GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it ca...
CVE-2022-24832 Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames
GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it ca...
PT-2022-16910
Name of the Vulnerable Software and Affected Versions GoCD versions prior to 22.1.0 Description The issue affects the gocd-ldap-authentication-plugin bundled with the GoCD Server, which fails to correctly escape special characters when using the username to construct LDAP queries. This allows an...
CVE-2022-24832: Improper Neutralization of Special Elements in Output Used by a Downstream Component
GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it ca...
GoCD 注入漏洞
GoCd is a continuous delivery server. GoCD suffers from an injection vulnerability that stems from the fact that the gocd-ldap-authentication-plugin included in GoCD Server fails to properly escape special characters when constructing an LDAP query using a username. An attacker could use this...
