42 matches found
CVE-2026-92139
Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...
CVE-2026-92138
The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...
CVE-2026-92139
Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...
CVE-2026-92139
The Jenkins Bitbucket Push and Pull Request Plugin version 4.0.1 and earlier is vulnerable to a Server-Side Request Forgery (SSRF) flaw. The plugin provides a webhook endpoint at /bitbucket-hook/ that trusts values within the webhook payload, specifically certain URLs . An attacker can send a cra...
EUVD-2026-80763
Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...
CVE-2026-92138
The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...
CVE-2026-92138
The Jenkins Bitbucket Server Integration Plugin (atlassian-bitbucket-server-integration) versions 6.0.1 and earlier is vulnerable to an OAuth access token hijacking flaw. The OAuth authorization endpoint incorrectly reads the oauth_callback URL from the submitted form instead of using the server-...
EUVD-2026-80762
The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...
CVE-2026-92139
Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...
CVE-2026-92138
The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...
CVE-2026-92138: Insufficient Verification of Data Authenticity
The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...
CVE-2026-92139: Server-Side Request Forgery (SSRF)
Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...
Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation
Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for the connections it makes to Bitbucket Server using Bearer token authentication. Because the Bearer token is transmitted in these requests, this allows attacker...
PT-2026-51799
Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Push and Pull Request Plugin versions prior to 3.3.9 Description The plugin unconditionally disables SSL/TLS certificate and hostname validation when sending Bearer token authenticated requests to the configured Bitbucket...
CVE-2026-57289: Improper Certificate Validation
Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to...
CVE-2026-48924
Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...
CVE-2026-48924: URL Redirection to Untrusted Site
Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...
CVE-2025-64148
A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...