CVE-2018-1000419

An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins...

Authorization

An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to send test notifications to an attacker-specified HipChat server with attacker-specified credentials IDs obtained through another...

Authorization

An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins...

CVE-2018-1000418

An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to send test notifications to an attacker-specified HipChat server with attacker-specified credentials IDs obtained through another...

CVE-2018-1000419

The CVE-2018-1000419 entry concerns Jenkins HipChat Plugin (versions up to 2.2.0). The vulnerability lies in HipChatNotifier.java, enabling attackers with Overall/Read access to enumerate credentials IDs stored in Jenkins. Public references (GHSA, NVD) indicate that from version 2.2.1 the plugin ...

CVE-2018-1000418

CVE-2018-1000418 affects Jenkins HipChat Plugin (versions ≤ 2.2.0). The HipChatNotifier.java improper authorization allows users with Overall/Read access to trigger test notifications to an attacker-controlled HipChat server using attacker-specified credential IDs, enabling capture of credentials...

CVE-2018-1000419

An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins...

CVE-2018-1000418: Incorrect Authorization

An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to send test notifications to an attacker-specified HipChat server with attacker-specified credentials IDs obtained through another...

PT-2019-8730

Name of the Vulnerable Software and Affected Versions Jenkins HipChat Plugin versions 2.2.0 and earlier Description An improper authorization issue exists in the Jenkins HipChat Plugin, specifically in HipChatNotifier.java, allowing attackers with Overall/Read access to obtain credentials IDs for...

CVE-2018-1000419: Undefined Security Weakness

An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins...

GitLab CE/EE Server-Side Request Forgery Vulnerability

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing a project's file contents, commit history, bug lists, and more. A server-side request forgery...

GitLab: Exfiltrate and mutate repository and project data through injected templated service

The GitLab import feature contains a vulnerability that allows an attacker to import a project that creates a service template. Service templates can normally only be created by a GitLab instance Administrator. When a new project is created, service templates are automatically initialized for the...

CSRF vulnerability and missing permission checks in HipChat Plugin allowed capturing credentials

HipChat Plugin did not perform permission checks on a method that sends test notifications. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified HipChat server using attacker-specified connection settings and credentials IDs obtained through another method,...

Hipchat For Mac 4.x Remote Code Execution Vulnerability

Hipchat for Mac desktop client versions prior to 4.30 suffer from a remote code execution vulnerability. Hipchat For Mac 4.x Remote Code Execution CVE-2017-14586. Product: Hipchat for Mac desktop client. Affected Hipchat for Mac desktop client product versions: 4.0 = 4.0 but less than 4.30 please...

Atlassian Hipchat Server and Hipchat Data Center Remote Code Execution Vulnerability

Atlassian Hipchat Server and Hipchat Data Center are both products of Atlassian Australia.Hipchat Server is a set of team chatting tools that supports group and 1-to-1 voice and video chatting and screen sharing.Hipchat Data Center is a set of Hipchat Data Center is a data center system. A...

Hipchat Data Center / Hipchat Server Code Execution / SSRF Vulnerabilities

Hipchat Data Center and Hipchat Server suffer from server-side request forgery and remote code execution vulnerabilities. Hipchat Data Center / Hipchat Server Code Execution / SSRF Vulnerabilities Products: Hipchat Data Center, Hipchat Server CVE ID: CVE-2017-14585 Affected Hipchat Data Center...

Atlassian Hipchat for Mac Remote Code Execution Vulnerability

Atlassian Hipchat is self-hosted group chat tool. Atlassian Hipchat for Mac version 4.0 suffers from a remote code execution vulnerability in its implementation, which can be exploited by an attacker to execute arbitrary code in the context of the affected application...

Server side request forgery (ssrf)

A Server Side Request Forgery SSRF vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and before 2.2.6 are affecte...

CVE-2017-14586

The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipchat for Mac desktop clients at or above version 4.0 and before version 4.30 are affected by this vulnerability...

CVE-2017-14585

A Server Side Request Forgery SSRF vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and before 2.2.6 are affecte...