Jenkins Plugin Mercurial 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2022-43410: Exposure of Sensitive Information to an Unauthorized Actor

Jenkins Mercurial Plugin 1251.vab121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access...

CVE-2022-43410

CVE-2022-43410 concerns the Jenkins Mercurial Plugin (1251.va_b_121f184902 and earlier) where the webhook endpoint /mercurial/notifyCommit can reveal which jobs were triggered or scheduled for polling, including those the viewer lacks permission to access. This constitutes information disclosure ...

Lack of webhook authentication mechanism in tuleap-git-branch-source

tuleap-git-branch-source provides a webhook endpoint at /tuleap-hook/ that can be used to trigger Tuleap projects configured with a specified repository. In tuleap-git-branch-source 3.2.4 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attackers to...

PT-2022-25750 · Jenkins · Jenkins Rundeck Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Rundeck Plugin versions 3.6.11 and earlier Description: The issue allows users with Overall/Read permission to trigger jobs configured to be triggerable via Rundeck, due to inadequate protection of access to the...

Jenkins Rundeck Plugin 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PT-2022-20879

Name of the Vulnerable Software and Affected Versions Harbor versions prior to 2.5.2 Description The issue allows malicious users to view, update, and delete Webhook policies of other users due to a failure in validating user permissions. This can be exploited through the API endpoint "GET...

GHSA-V878-67XW-GRW2 Lack of authentication mechanism in Jenkins Git Plugin webhook

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Gi...

CVE-2022-36884

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository...

CVE-2022-36884: Missing Authentication for Critical Function

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository...

Jenkins Git Plugin 访问控制错误漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. An Access Control Error...

Kubernetes: API Server DoS (crash?) if many large resources (~1MB each) are concurrently/repeatedly sent to an external Validating WebHook endpoint

Report Submission Form Summary: I was trying to explore a way to stealthily send lots of data outside a private GKE cluster by way of misusing the Validating Webhook mechanism. The idea would be that a cluster-admin could install a webhook and then initiate resources like a secret or configmap th...