com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6), org.jenkins-ci.plugins.workflow:workflow-aggregator (1.15) +1 more potentially affected by CVE-2022-25174 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.15)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - com.qasymphony.ci.jenkins:qtest =1.3.0, =1.0.4,...

com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6), org.jenkins-ci.plugins.workflow:workflow-aggregator (1.15) +1 more potentially affected by CVE-2022-25178 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.15)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - com.qasymphony.ci.jenkins:qtest =1.3.0, =1.0.4,...

com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6), org.jenkins-ci.plugins.workflow:workflow-aggregator (1.15) +1 more potentially affected by CVE-2022-25182 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.15)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - com.qasymphony.ci.jenkins:qtest =1.3.0, =1.0.4,...

CSRF vulnerability and missing permission checks in pipeline-githubnotify-step allows capturing credentials

pipeline-githubnotify-step 1.0.4 and earlier does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturi...

Users with Overall/Read access can enumerate credential IDs in pipeline-githubnotify-step

pipeline-githubnotify-step 1.0.4 and earlier provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs...