org.jenkins-ci.plugins:gogs-webhook (>=1.0.0, <=1.0.15) potentially affected by CVE-2017-1000092 via org.jenkins-ci.plugins:git (2.2.5)

org.jenkins-ci.plugins:git MAVEN version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:gogs-webhook =1.0.0, =1.0.15 Source cves: CVE-2017-1000092 Source advisory:...

org.jenkins-ci.plugins:assembla-merge-request-builder (>=1.1.1, <=1.1.13), org.jenkins-ci.plugins:bitbucket-pullrequest-builder (>=1.4.6, <=1.4.28) +5 more potentially affected by CVE-2017-1000242 via org.jenkins-ci.plugins:git-client (1.10.1)

org.jenkins-ci.plugins:git-client MAVEN version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:assembla-merge-request-builder =1.1.1, =1.4.6, =1.13-1, =2.2.3, =1.0....

org.jenkins-ci.plugins:gogs-webhook (>=1.0.0, <=1.0.15) potentially affected by CVE-2018-1000182 via org.jenkins-ci.plugins:git (2.2.5)

org.jenkins-ci.plugins:git MAVEN version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:gogs-webhook =1.0.0, =1.0.15 Source cves: CVE-2018-1000182 Source advisory:...

gogs-webhook stored credentials in plain text

gogs-webhook stored credentials unencrypted in job config.xml files on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or access to the Jenkins controller file system. gogs-webhook now stores credentials encrypted...