Bitbucket Server Integration Plugin allows bypassing CSRF protection for any URL

An extension point in Jenkins allows selectively disabling cross-site request forgery CSRF protection for specific URLs. Bitbucket Server Integration Plugin implements this extension point to support OAuth 1.0 authentication. In Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusi...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2025-24398

The CVE-2025-24398 entry corresponds to a CSRF bypass vulnerability in the Jenkins Bitbucket Server Integration Plugin. Affected versions 2.1.0–4.1.3 implement an overly permissive extension point that can disable CSRF protection for arbitrary URLs, enabling attackers to craft links that bypass C...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

CVE-2025-24398

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusive allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...

SUSE CVE-2024-57941

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix the non-cancellation of copy when cache is temporarily disabled When the caching for a cookie is temporarily disabled e.g. due to a DIO write on that file, future copying to the cache for that file is disabled until al...

PT-2025-5356 · Jenkins · Jenkins Bitbucket Server Integration Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Bitbucket Server Integration Plugin versions 2.1.0 through 4.1.3 Description: The issue allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. This is due to an overly permissive...

Jenkins plugin Bitbucket Server Integration 跨站请求伪造漏洞

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security vulnerability in...

CVE-2025-21564

Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain component: Agile Integration Services. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM...

CVE-2025-21556

Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain component: Agile Integration Services. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM...

CVE-2025-24458

In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration...

CVE-2025-24458

In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration...

CVE-2025-24458

In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration...

CVE-2025-24458

In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration...

CVE-2025-24458

Summary (CVE-2025-24458): JetBrains YouTrack prior to 2024.3.55417 is affected by an account takeover vulnerability via spoofed email and Helpdesk integration. The vulnerability is described across multiple sources as allowing unauthorized access through manipulated emails and helpdesk workflows,...

JetBrains YouTrack 安全漏洞

JetBrains YouTrack is a project management tool developed by the Czech company JetBrains that supports cloud hosting and local deployment. JetBrains YouTrack suffers from a security vulnerability that stems from account takeover via spoofed emails and Helpdesk integration. No details of the...

PT-2025-5364 · Jetbrains · Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.55417 Description: The issue allows for account takeover via spoofed email and Helpdesk integration. This enables unauthorized access to accounts, potentially leading to data breaches or other...

Product Walkthrough: How Satori Secures Sensitive Data From Production to AI

Every week seems to bring news of another data breach, and it's no surprise why: securing sensitive data has become harder than ever. And it's not just because companies are dealing with orders of magnitude more data. Data flows and user roles are constantly shifting, and data is stored across...

The vulnerability of the server for the Continuous Integration and Delivery (CI/CD) system GoCD arises due to an incorrect path name limitation for the restricted access directory. This allows a malicious actor to execute arbitrary code.

The vulnerability of the CI/CD GoCD server exists due to an incorrect pathname limitation for the access-controlled directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

MAL-2025-131 Malicious code in payment-integration-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e2b48477c18dc833e42ed72d5398cea9fd403d04bb4f0c43a833f3d97068ae01 The OpenSSF Package Analysis project identified 'payment-integration-template' @ 1.1.0 npm as malicious. It is considered malicious because: - T...