26 matches found
CVE-2026-92140
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...
EUVD-2026-80764
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...
CVE-2026-92140
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...
CVE-2026-92140
The Jenkins Gitee Plugin (version 1301.v8957053c7902 and earlier) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the failure to escape the sender name from Gitee push webhook payloads in build causes. Attackers capable of triggering builds via the Jenkins Gi...
CVE-2026-92140
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...
CVE-2026-92140: Improper Neutralization of Input During Web Page Generation
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...
Jenkins Gitee Plugin missing permission checks
Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier does not perform permission checks in several HTTP endpoints implementing form validation for its global configuration. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentia...
Jenkins Gitee Plugin has a cross-site request forgery vulnerability
Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier does not perform permission checks in several HTTP endpoints implementing form validation for its global configuration. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentia...
Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs
Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier does not correctly perform a permission check in an HTTP endpoint. This allows attackers with global Item/Configure permission while lacking Item/Configure permission on any particular job to enumerate credentials IDs of credentials stored in...
CVE-2026-57292
A cross-site request forgery CSRF vulnerability in Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...
CVE-2026-57291
Missing permission checks in Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...
EUVD-2026-38774
An incorrect permission check in Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier allows attackers with global Item/Configure permission while lacking Item/Configure permission on any particular job to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2026-57293
The Jenkins Gitee Plugin (version 1288.v18b_deb_c9069b_ and earlier) contains an incorrect permission check in an HTTP endpoint. This flaw allows attackers who possess global Item/Configure permissions, but lack specific Item/Configure permissions on individual jobs, to enumerate credentials IDs ...
CVE-2026-57292
A cross-site request forgery CSRF vulnerability in Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...
CVE-2026-57291
Missing permission checks in Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...
CVE-2026-57292
The Jenkins Gitee Plugin (version 1288.v18b_deb_c9069b and earlier) is vulnerable to a cross-site request forgery (CSRF) attack. The root cause is that several HTTP endpoints used for global configuration form validation lack sufficient permission checks and do not require POST requests. This all...
EUVD-2026-38772
Missing permission checks in Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...
CVE-2026-57291
Missing permission checks in Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...
CVE-2026-57292
A cross-site request forgery CSRF vulnerability in Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...
CVE-2026-57292
A cross-site request forgery CSRF vulnerability in Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...