CVE-2022-34777

Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-34777

Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-34777

Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

Cross site scripting

Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

PT-2022-22328 · Jenkins · Jenkins Git Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins GitLab Plugin versions 1.5.34 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the plugin does not escape multiple fields inserted into the description of...

Jenkins Plugin GitLab 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.A cross-site scripting vulnerability exis...

PT-2022-22354 · Jenkins · Jenkins Rocketchat Notifier Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins RocketChat Notifier Plugin versions 1.5.2 and earlier Description: The issue concerns the storage of sensitive information in the global configuration file on the Jenkins controller. Specifically, the login password and webhook token...

MAL-2022-6708 Malicious code in twitter-webhook-boilerplate-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4c54edfa90310f933c9c48f23b3e0d63b678c99863e73ed61a71cfbc0cea32e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in twitter-webhook-boilerplate-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4c54edfa90310f933c9c48f23b3e0d63b678c99863e73ed61a71cfbc0cea32e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in webhook-provisioner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 697ea38acf4a193645bda704d70e5d5e598227df1456666b6997d1c09ffcbacd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7096 Malicious code in webhook-provisioner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 697ea38acf4a193645bda704d70e5d5e598227df1456666b6997d1c09ffcbacd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in collection-events-discord-webhook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d12cf97df99bb97e69ef2b265ec820acb8cc39d7026d03d62e053b706505142 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

GHSA-5Q86-62XR-3R57 Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

Account Takeover via Webhook Handlebars + API Reset Password

Description Through the Webhook functionality, the attacker is able to use Handlebars to capture sensitive user data. Capturing the emailverificationtoken, which through the API I found the PasswordForget function, enabling account takeover via password reset. Steps 1. - Create Table 2. - Select...

GHSA-W689-557M-2CVQ Server-Side Request Forgery in gogs webhook

Impact The malicious user is able to discover services in the internal network through webhook functionality. All installations accepting public traffic are affected. Patches Webhook payload URLs are revalidated before each delivery to make sure they are not resolved to blocked local network...

Server-Side Request Forgery in gogs webhook

Impact The malicious user is able to discover services in the internal network through webhook functionality. All installations accepting public traffic are affected. Patches Webhook payload URLs are revalidated before each delivery to make sure they are not resolved to blocked local network...

Server-side Request Forgery (SSRF)

github.com/gogs/gogs is vulnerable to server-side request forgery. The vulnerability exists because the isLocalHostname function of webhook.go does not properly validate the IP addresses before redirect, allowing an attacker to gain access to response data by making an HTTP request to untrusted U...

PT-2022-13774

Name of the Vulnerable Software and Affected Versions gogs/gogs versions prior to 0.12.8 Description The issue is related to a Server-Side Request Forgery SSRF in the GitHub repository gogs/gogs. This allows a malicious user to discover services in the internal network through webhook...

XXE vulnerability in Jenkins Generic Webhook Trigger Plugin

Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with the ability to call webhooks configured to extract parameters using XPath to have Jenkins parse a crafted XML request body that uses...