org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (>=2.0.0-beta-1, <=2.1.2), org.jenkins-ci.plugins:git (>=2.6.0, <=2.6.5) +5 more potentially affected by CVE-2025-67640 via org.jenkins-ci.plugins:git-client (1.21.0)

org.jenkins-ci.plugins:git-client MAVEN version 1.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source =2.0.0-beta-1, =2.6.0, =1.0,...

EUVD-2022-0718

Malicious code in bioql PyPI...

de.wellnerbou.jenkins:git-changelog (>=3.0, <=3.31), org.jenkins-ci.plugins:bitbucket (>=1.1.2, <=1.1.13) +4 more potentially affected by CVE-2025-58458 via org.jenkins-ci.plugins:git-client (1.16.1)

org.jenkins-ci.plugins:git-client MAVEN version 1.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - de.wellnerbou.jenkins:git-changelog =3.0, =1.1.2, =1.3, =0.1, =1.0.0, =2.5 Source cves:...

org.jenkins-ci.plugins:bitbucket-approval-filter (1.0.0) potentially affected by CVE-2024-39460 via org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.4.1)

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source and may be impacted: - org.jenkins-ci.plugins:bitbucket-approval-filte...

org.jenkins-ci.plugins:bitbucket-filter-project-trait (1.0) potentially affected by CVE-2024-39460 via org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.2.13)

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source MAVEN version 2.2.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source and may be impacted: -...

GHSA-X8MF-JCMF-R79F Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin

Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases. Bitbucket Branch Source Plugin 887.vad359b3d2d8d does not include the Bitbucket OAuth access token as part of the Bitbucket URL in the...

org.jenkins-ci.plugins:skip-notifications-trait (>=1.0.0, <=1.0.2) potentially affected by CVE-2024-39460 via org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.2.0)

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source and may be impacted: - org.jenkins-ci.plugins:skip-notifications-trait...

CVE-2024-39460

Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases...

CVE-2024-39460: Insertion of Sensitive Information into Log File

Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases...

Bitbucket OAuth access token exposed in the build log by cloudbees-bitbucket-branch-source

cloudbees-bitbucket-branch-source 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases. cloudbees-bitbucket-branch-source 887.vad359b3d2d8d does not include the Bitbucket OAuth access token as part of the Bitbucket URL i...

CVE-2024-28152

A flaw was found in jenkins-2-plugins. Multibranch Pipelines with a Bitbucket branch source can be configured to discover pull requests from forks. The trust policy is set to "Forks in the same account" by default. In Bitbucket Branch Source Plugin 866.vdea7dcd3008e and earlier, except...

org.jenkins-ci.plugins:bitbucket-filter-project-trait (1.0) potentially affected by CVE-2024-28152 via org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.2.13)

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source MAVEN version 2.2.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source and may be impacted: -...

org.jenkins-ci.plugins:bitbucket-approval-filter (1.0.0) potentially affected by CVE-2024-28152 via org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.4.1)

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source and may be impacted: - org.jenkins-ci.plugins:bitbucket-approval-filte...

org.jenkins-ci.plugins:skip-notifications-trait (>=1.0.0, <=1.0.2) potentially affected by CVE-2024-28152 via org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.2.0)

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source and may be impacted: - org.jenkins-ci.plugins:skip-notifications-trait...

CVE-2024-28152

In Jenkins Bitbucket Branch Source Plugin 866.vdea7dcd3008e and earlier, except 848.850.v6aa2a234ac81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server...

CVE-2024-28152

The Jenkins Bitbucket Branch Source Plugin (specifically versions 866.vdea_7dcd3008e and earlier, excluding 848.850.v6a_a_2a_234a_c81 ) is vulnerable to an improper access control flaw when using Bitbucket Server . When discovering pull requests from forks, the default "Forks in the same account"...

org.jenkins-ci.plugins:bitbucket-approval-filter (1.0.0), org.jenkins-ci.plugins:bitbucket-filter-project-trait (1.0) +1 more potentially affected by CVE-2024-28152 via org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (>=2.2.0, <=2.4.1)

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source MAVEN version =2.2.0, =1.0.0, =1.0.2 Source cves: CVE-2024-28152 Source advisory: MEND:CVE-2024-28152...

CVE-2024-28152: Improper Preservation of Permissions

In Jenkins Bitbucket Branch Source Plugin 866.vdea7dcd3008e and earlier, except 848.850.v6aa2a234ac81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server...

Incorrect trust policy behavior for pull requests from forks in cloudbees-bitbucket-branch-source

Multibranch Pipelines with Bitbucket branch source can be configured to discover pull requests from forks. The trust policy is set to "Forks in the same account" by default. In cloudbees-bitbucket-branch-source 866.vdea7dcd3008e and earlier, except 848.850.v6aa2a234ac81, this trust policy allows...

org.jenkins-ci.plugins:bitbucket (>=1.1.4, <=1.1.13), org.jenkins-ci.plugins:bitbucket-build-status-notifier (>=1.1.0, <=1.4.2) +2 more potentially affected by CVE-2022-43410 via org.jenkins-ci.plugins:mercurial (1.54)

org.jenkins-ci.plugins:mercurial MAVEN version 1.54 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:mercurial and may be impacted: - org.jenkins-ci.plugins:bitbucket =1.1.4, =1.1.0, =1.3, =1.1.0, =1.1.2 Source cves: CVE-2022-4341...