io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45), org.jenkins-ci.plugins:git (3.0.0) +3 more potentially affected by CVE-2026-57282 via org.jenkins-ci.plugins:git-client (2.0.0)

org.jenkins-ci.plugins:git-client MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =y, =0.25, =0.5, =0.6 Source cves: CVE-2026-57282...

at.porscheinformatik.zanata:zanata-spring (>=1.0.0.release, <=1.1.0.release), ca.appsimulations:jlqninterface (>=1.0.0, <=1.1.0) +1586 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.13.release)

org.springframework:spring-expression MAVEN version 4.3.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.porscheinformatik.zanata:zanata-spring =1.0.0.release, =1.0.0, =1.0.2,...

EUVD-2013-4351

Malware in sbrugna...

EUVD-2023-2693

Malicious code in bioql PyPI...

org.jboss.resteasy:resteasy-jaxrs-war (2.1.0.ga), org.zanata:zanata-adapter-glossary (>=1.8.0, <=2.1.1) +10 more potentially affected by CVE-2023-0482 via org.jboss.resteasy:resteasy-multipart-provider (2.1.0.ga)

org.jboss.resteasy:resteasy-multipart-provider MAVEN version 2.1.0.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-multipart-provider and may be impacted: - org.jboss.resteasy:resteasy-jaxrs-war 2.1.0.ga -...

at.porscheinformatik.zanata:common (>=4.7.0, <=4.7.8), at.porscheinformatik.zanata:stub-server (>=4.7.0, <=4.7.8) +542 more potentially affected by CVE-2023-0482 via org.jboss.resteasy:resteasy-multipart-provider (>=3.0-beta-1, <=3.15.3.final)

org.jboss.resteasy:resteasy-multipart-provider MAVEN version =3.0-beta-1, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =1.0.0, =0.0.2, =0.0.20 and more Source cves: CVE-2023-0482 Source advisory: GHSA-2C6G-PFX3-W7H8...

GHSA-86J9-25M2-9W97 Non-constant time webhook token hash comparison in Jenkins Zanata Plugin

Jenkins Zanata Plugin 0.6 and earlier does not use a constant-time comparison when checking whether the provided and expected webhook token hashes are equal. This could potentially allow attackers to use statistical methods to obtain a valid webhook token. As of publication of this advisory, ther...

Non-constant time webhook token hash comparison in Jenkins Zanata Plugin

Jenkins Zanata Plugin 0.6 and earlier does not use a constant-time comparison when checking whether the provided and expected webhook token hashes are equal. This could potentially allow attackers to use statistical methods to obtain a valid webhook token. As of publication of this advisory, ther...

CVE-2023-46660

Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...

CVE-2023-46660

Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...

Code injection

Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...

CVE-2023-46660

Summary: CVE-2023-46660 affects Jenkins Zanata Plugin prior to 0.7 (0.6 and earlier) and is due to a non-constant time comparison when verifying webhook token hashes. This vulnerable check could enable attackers to use statistical methods to obtain a valid webhook token, as stated in multiple sou...

CVE-2023-46660

Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...

CVE-2023-46660

Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...

CVE-2023-46660

Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...

CVE-2023-46660: Incorrect Comparison

Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...

Jenkins Plugin Zanata Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PT-2023-30147 · Jenkins · Jenkins Zanata Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Zanata Plugin versions 0.6 and earlier Description: The issue is related to the use of a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal. This potentially allows...

Non-constant time webhook token hash comparison in zanata

zanata 0.6 and earlier does not use a constant-time comparison when checking whether the provided and expected webhook token hashes are equal. This could potentially allow attackers to use statistical methods to obtain a valid webhook token. As of publication of this advisory, there is no fix...

io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45), org.jenkins-ci.plugins:git (3.0.0) +3 more potentially affected by CVE-2022-36881 via org.jenkins-ci.plugins:git-client (2.0.0)

org.jenkins-ci.plugins:git-client MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =y, =0.25, =0.5, =0.6 Source cves: CVE-2022-36881...