4232 matches found
Jenkins Quay.io trigger Plugin webhook endpoint can be accessed without authentication
Jenkins Quay.io trigger Plugin provides a webhook endpoint at /quayio-webhook/ that can be used to trigger builds of jobs configured to use a specified repository. In Quay.io trigger Plugin 0.1 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attacker...
GHSA-Q2FC-9WW2-GGFJ Jenkins Quay.io trigger Plugin webhook endpoint can be accessed without authentication
Jenkins Quay.io trigger Plugin provides a webhook endpoint at /quayio-webhook/ that can be used to trigger builds of jobs configured to use a specified repository. In Quay.io trigger Plugin 0.1 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attacker...
GHSA-2482-GR3V-F3F3 Jenkins Fogbugz Plugin has missing permissions check
Jenkins Fogbugz Plugin provides a webhook endpoint at /fbTrigger/ that can be used to trigger builds of any jobs. In Fogbugz Plugin 2.2.17 and earlier, this endpoint can be accessed by attackers with Item/Read permission, allowing them to trigger builds of jobs specified in a jobname request...
Jenkins Assembla merge request builder Plugin missing authentication to access endpoint
Jenkins Assembla merge request builder Plugin provides a webhook endpoint at /assembla-webhook/ that can be used to trigger builds of jobs configured to use a specified repository. In Assembla merge request builder Plugin 1.1.13 and earlier, this endpoint can be accessed without authentication...
GHSA-JR86-6J4J-MV45 Jenkins Assembla merge request builder Plugin missing authentication to access endpoint
Jenkins Assembla merge request builder Plugin provides a webhook endpoint at /assembla-webhook/ that can be used to trigger builds of jobs configured to use a specified repository. In Assembla merge request builder Plugin 1.1.13 and earlier, this endpoint can be accessed without authentication...
Jenkins Fogbugz Plugin has missing permissions check
Jenkins Fogbugz Plugin provides a webhook endpoint at /fbTrigger/ that can be used to trigger builds of any jobs. In Fogbugz Plugin 2.2.17 and earlier, this endpoint can be accessed by attackers with Item/Read permission, allowing them to trigger builds of jobs specified in a jobname request...
Lack of authentication mechanism in Jenkins TurboScript Plugin webhook
A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository...
GHSA-7GQC-Q9MC-6348 Lack of authentication mechanism in Jenkins TurboScript Plugin webhook
A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository...
CVE-2023-30520
Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads...
PT-2023-22746 · Jenkins · Jenkins Quay.Io Trigger Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Quay.io trigger Plugin versions 0.1 and earlier Description: A missing permission check in the Jenkins Quay.io trigger Plugin allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repositor...
PT-2023-22750 · Jenkins · Jenkins Fogbugz Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Fogbugz Plugin versions 2.2.17 and earlier Description: A missing permission check in the Jenkins Fogbugz Plugin allows attackers with Item/Read permission to trigger builds of jobs specified in a jobname request parameter. The plugin...
CVE-2023-0838
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342...
UBUNTU-CVE-2023-0838
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342...
Design/Logic Flaw
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342...
PT-2023-16560 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 15.1 through 15.8.4 GitLab versions 15.9 through 15.9.3 GitLab versions 15.10 through 15.10.0 Description: An issue in GitLab allows a maintainer to modify a webhook URL, potentially leaking masked webhook secrets by adding a...
CVE-2023-0838
GitLab CVE-2023-0838 affects GitLab CE/EE versions 15.1–15.8.4, 15.9.0–15.9.3, and 15.10.0–15.10.0 (i.e., before 15.8.5, 15.9.4, and 15.10.1). The issue allows a maintainer to modify a webhook URL to leak masked webhook secrets by adding a new parameter to the URL, addressing an incomplete fix fo...
CVE-2023-0838
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342...
CVE-2023-0838
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342...
CVE-2023-0838
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342...
