374 matches found
CVE-2017-1000092: Cross-Site Request Forgery (CSRF)
Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenki...
CVE-2017-1000092
Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenki...
CVE-2017-1000092
Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenki...
br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1), com.amcbridge:build-configurator (>=1.0.5.0, <=1.0.6.1) +80 more potentially affected by CVE-2017-1000092 via org.jenkins-ci.plugins:git (>=1.2.0, <=3.3.1)
org.jenkins-ci.plugins:git MAVEN version =1.2.0, =1.0.5.0, =1.1.0, =1.9.2-beta, =1.9, =4.0.9, =1.1.0, =1.0.0, =1.0.1, =1.1.3, =1.7.2, =1.1.0, =1.0.0, =1.0.22, =1.0.57 and more Source cves: CVE-2017-1000092 Source advisory: MEND:CVE-2017-1000092...
CVE-2017-1000092
CVE-2017-1000092 concerns the Jenkins Git Plugin. A maliciously crafted Jenkins URL could cause the Git client to transmit credentials to an attacker-controlled server, enabling credential leakage via a CSRF-like scenario. The entry notes that an attacker with no Jenkins access but with knowledge...
PT-2017-10797
Name of the Vulnerable Software and Affected Versions Jenkins Git Plugin affected versions not specified Description The issue allows an attacker to potentially obtain username and password credentials by tricking a developer into following a maliciously crafted Jenkins URL. This URL would cause...
jenkins-plugin-git: CSRF vulnerability allows capturing credentials (SECURITY-528)
The Git Plugin can leak credentials username and password used to access a git repo if an attacker-supplied URL is provided to the plugin. To supply the URL to the plugin, the attacker would need to guess a username/password ID and then trick a developer into following a specific URL...
CloudBees Jenkins Git Plugin Cross-Site Request Forgery Vulnerability
CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed tasks . Git Plugin is one of the plug-ins used to manage the...
CVE-2017-1000092
The Git Plugin can leak credentials username and password used to access a git repo if an attacker-supplied URL is provided to the plugin. To supply the URL to the plugin, the attacker would need to guess a username/password ID and then trick a developer into following a specific URL...
CVE-2016-10026
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revisio...
DEBIAN-CVE-2016-10026
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revisio...
CVE-2016-10026
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revisio...
PT-2017-7712
Name of the Vulnerable Software and Affected Versions ikiwiki version 3.20161219 Description The issue arises from inadequate checking of revision changes to access permissions for a page on sites utilizing the git and recentchanges plugins with the CGI interface enabled. This allows remote...
[SECURITY] [DSA 3275-1] fusionforge security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3275-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso May 30, 2015 http://www.debian.org/security/faq -...
FusionForge Git plugin is vulnerable
FusionForge is a collaborative team development environment , its main features include communication tools such as forums , news , etc. , development tools such as bug tracking , project management , etc. and community tools such as file distribution , software classification , etc..Git is one o...
CVE-2015-0850
The Git plugin for FusionForge before 6.0rc4 allows remote attackers to execute arbitrary code via an unspecified parameter when creating a secondary Git repository...
Code injection
The Git plugin for FusionForge before 6.0rc4 allows remote attackers to execute arbitrary code via an unspecified parameter when creating a secondary Git repository...
CVE-2015-0850
The Git plugin for FusionForge before 6.0rc4 allows remote attackers to execute arbitrary code via an unspecified parameter when creating a secondary Git repository...
CVE-2015-0850
The CVE-2015-0850 entry pertains to FusionForge’s Git plugin prior to 6.0rc4, where a vulnerability in the Git repository-creation parameter path allows remote arbitrary code execution. Affected component: FusionForge Git plugin (before 6.0rc4). Root cause: inadequate input handling when creating...