com.groupon.jenkins-ci.plugins:dotci (>=1.1.1, <=2.5.4), org.jenkins-ci.main:jenkins-test-harness (1.567) +4 more potentially affected by CVE-2024-43045 via org.jenkins-ci.main:jenkins-core (1.567)

org.jenkins-ci.main:jenkins-core MAVEN version 1.567 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =1.1.1, =1.3, =1.8, =1.8.1 Source cves: CVE-2024-43045...

com.groupon.jenkins-ci.plugins:dotci (>=2.10.0, <=2.28.1), com.groupon.jenkins-ci.plugins:dotci-dockerpublish (>=1.0.0, <=1.0.3) +8 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:jenkins-core (1.618)

org.jenkins-ci.main:jenkins-core MAVEN version 1.618 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =2.10.0, =1.0.0, =1.1.3, =1.7.2, =1.3.0, =1.0.0, =1.0, =1....

com.groupon.jenkins-ci.plugins:dotci (>=2.10.0, <=2.28.1), com.groupon.jenkins-ci.plugins:dotci-dockerpublish (>=1.0.0, <=1.0.3) +8 more potentially affected by CVE-2024-43045 via org.jenkins-ci.main:jenkins-core (1.618)

org.jenkins-ci.main:jenkins-core MAVEN version 1.618 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =2.10.0, =1.0.0, =1.1.3, =1.7.2, =1.3.0, =1.0.0, =1.0, =1....

com.groupon.jenkins-ci.plugins:dotci-fig-template (>=1.0.1, <=1.0.2), com.groupon.jenkins.plugins:dotci-plugins-starter-pack (>=1.0.0, <=1.1.1) +6 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:jenkins-core (1.518)

org.jenkins-ci.main:jenkins-core MAVEN version 1.518 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci-fig-template =1.0.1, =1.0.0, =1.1, =1.2 -...

com.groupon.jenkins-ci.plugins:dotci (>=2.10.0, <=2.28.1), com.groupon.jenkins-ci.plugins:dotci-dockerpublish (>=1.0.0, <=1.0.3) +8 more potentially affected by CVE-2023-39151 via org.jenkins-ci.main:jenkins-core (1.618)

org.jenkins-ci.main:jenkins-core MAVEN version 1.618 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =2.10.0, =1.0.0, =1.1.3, =1.7.2, =1.3.0, =1.0.0, =1.0, =1....

com.groupon.jenkins-ci.plugins:dotci (>=2.30.2, <=2.36.2), org.jenkins-ci.main:jenkins-war (1.655) +1 more potentially affected by CVE-2023-35141 via org.jenkins-ci.main:jenkins-core (1.655)

org.jenkins-ci.main:jenkins-core MAVEN version 1.655 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =2.30.2, =2.36.2 - org.jenkins-ci.main:jenkins-war 1.655 -...

com.groupon.jenkins.plugins:dotci-plugins-starter-pack (>=1.0.0, <=1.4.2) potentially affected by CVE-2023-28669 via org.jenkins-ci.plugins:jacoco (1.0.14)

org.jenkins-ci.plugins:jacoco MAVEN version 1.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:jacoco and may be impacted: - com.groupon.jenkins.plugins:dotci-plugins-starter-pack =1.0.0, =1.4.2 Source cves: CVE-2023-28669...

com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack (>=1.7.2, <=1.8.2), com.groupon.jenkins.plugins:dotci-plugins-starter-pack (>=1.5.0, <=1.7.1) potentially affected by CVE-2023-28669 via org.jenkins-ci.plugins:jacoco (1.0.19)

org.jenkins-ci.plugins:jacoco MAVEN version 1.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:jacoco and may be impacted: - com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack =1.7.2, =1.5.0, =1.7.1 Source cves:...

com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack (>=1.7.2, <=1.8.2), com.groupon.jenkins.plugins:dotci-plugins-starter-pack (>=1.0.0, <=1.7.1) +1 more potentially affected by CVE-2023-28669 via org.jenkins-ci.plugins:jacoco (>=1.0.9, <=1.0.19)

org.jenkins-ci.plugins:jacoco MAVEN version =1.0.9, =1.7.2, =1.0.0, =1.7, =1.12.3 Source cves: CVE-2023-28669 Source advisory: MEND:CVE-2023-28669...

com.groupon.jenkins-ci.plugins:dotci (>=1.1.1, <=2.5.4), org.jenkins-ci.main:jenkins-test-harness (1.567) +4 more potentially affected by CVE-2023-27904 via org.jenkins-ci.main:jenkins-core (1.567)

org.jenkins-ci.main:jenkins-core MAVEN version 1.567 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =1.1.1, =1.3, =1.8, =1.8.1 Source cves: CVE-2023-27904...

com.groupon.jenkins-ci.plugins:dotci (>=2.30.2, <=2.36.2), org.jenkins-ci.main:jenkins-war (1.655) +1 more potentially affected by CVE-2023-27899 via org.jenkins-ci.main:jenkins-core (1.655)

org.jenkins-ci.main:jenkins-core MAVEN version 1.655 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =2.30.2, =2.36.2 - org.jenkins-ci.main:jenkins-war 1.655 -...

com.groupon.jenkins-ci.plugins:dotci (>=2.30.2, <=2.36.2), org.jenkins-ci.main:jenkins-war (1.655) +1 more potentially affected by CVE-2023-27898 via org.jenkins-ci.main:jenkins-core (1.655)

org.jenkins-ci.main:jenkins-core MAVEN version 1.655 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =2.30.2, =2.36.2 - org.jenkins-ci.main:jenkins-war 1.655 -...

com.groupon.jenkins-ci.plugins:dotci (>=2.30.2, <=2.36.2), org.jenkins-ci.main:jenkins-war (1.655) +1 more potentially affected by CVE-2023-27904 via org.jenkins-ci.main:jenkins-core (1.655)

org.jenkins-ci.main:jenkins-core MAVEN version 1.655 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =2.30.2, =2.36.2 - org.jenkins-ci.main:jenkins-war 1.655 -...

com.groupon.jenkins-ci.plugins:dotci (>=1.1.1, <=2.5.4), org.jenkins-ci.main:jenkins-test-harness (1.567) +4 more potentially affected by CVE-2023-27898 via org.jenkins-ci.main:jenkins-core (1.567)

org.jenkins-ci.main:jenkins-core MAVEN version 1.567 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =1.1.1, =1.3, =1.8, =1.8.1 Source cves: CVE-2023-27898...

com.groupon.jenkins-ci.plugins:dotci (>=1.0.0, <=1.1.0), org.jenkins-ci.main:jenkins-test-harness (1.502) +5 more potentially affected by CVE-2023-27899 via org.jenkins-ci.main:jenkins-core (1.502)

org.jenkins-ci.main:jenkins-core MAVEN version 1.502 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =1.0.0, =0.0.1, =0.0.7 - org.jenkins-ci.plugins:plugin 1.5...

com.groupon.jenkins-ci.plugins:dotci (>=2.10.0, <=2.28.1), com.groupon.jenkins-ci.plugins:dotci-dockerpublish (>=1.0.0, <=1.0.3) +8 more potentially affected by CVE-2023-27903 via org.jenkins-ci.main:jenkins-core (1.618)

org.jenkins-ci.main:jenkins-core MAVEN version 1.618 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =2.10.0, =1.0.0, =1.1.3, =1.7.2, =1.3.0, =1.0.0, =1.0, =1....

com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack (>=1.7.2, <=1.8.2), com.groupon.jenkins.plugins:dotci-plugins-starter-pack (>=1.4.2, <=1.7.1) +3 more potentially affected by CVE-2023-25761 via org.jenkins-ci.plugins:junit (1.8)

org.jenkins-ci.plugins:junit MAVEN version 1.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack =1.7.2, =1.4.2, =2.0, =2.0.1, =2.2.13, =2.2.17...

GHSA-X3JJ-RGW9-7R5G RCE vulnerability in Jenkins DotCi Plugin

DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution RCE vulnerability exploitable by attackers able to modify .ci.yml files in SCM. This plugin has been suspended...

GHSA-9MC6-VGMQ-X6XF Lack of authentication mechanism in Jenkins DotCi Plugin webhook

DotCi Plugin provides a webhook endpoint at /githook/ that can be used to trigger builds of the job for a GitHub repository. In DotCi Plugin 2.40.00 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attackers to trigger builds of jobs corresponding to...

GHSA-Q9G4-9FX4-V533 Stored XSS vulnerability in Jenkins DotCi Plugin

DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted commit notifications to the...