64 matches found
CVE-2025-59531
CVE-2025-59531 affects Argo CD versions 1.2.0–1.8.7, 2.0.0-rc1–2.14.19, and 3.0.0-rc1–3.2.0-rc1, plus 3.1.7 and 3.0.18. The issue arises when the webhook Bitbucket Server payload is malformed and webhook.bitbucketserver.secret is not configured, causing the /api/webhook endpoint to crash and pote...
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload
Summary Unpatched Argo CD versions are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process whe...
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
Summary Unpatched Argo CD versions are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no webhook.bitbucketserver.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server...
GHSA-W92J-C6GR-HJ8R Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions
Mattermost Confluence Plugin versions 1.5.0 fail to handle unexpected request bodies, allow\ing attackers to crash the plugin via constant hits to the server webhook endpoint with an invalid request body...
CVE-2023-41937
Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 both inclusive trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by...
CVE-2022-4255
An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user email id through webhook payload...
GO-2025-3509 Vela Server Has Insufficient Webhook Payload Data Verification in github.com/go-vela/server
Vela Server Has Insufficient Webhook Payload Data Verification in github.com/go-vela/server...
Vela Server Has Insufficient Webhook Payload Data Verification
Impact Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit. Any user with access to the CI instance and the linked source control manager can perform the exploit. Method By spoofing a webhook payload with a specific set of headers and body...
GHSA-9M63-33Q3-XQ5X Vela Server Has Insufficient Webhook Payload Data Verification
Impact Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit. Any user with access to the CI instance and the linked source control manager can perform the exploit. Method By spoofing a webhook payload with a specific set of headers and body...
CVE-2025-27616 Vela Server has Insufficient Webhook Payload Data Verification
Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to ...
CVE-2025-27616
Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to ...
CVE-2025-27616
Vela Server (CI/CD framework) is affected in versions prior to 0.25.3 and 0.26.3. By spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo-level CI secrets to another repository. Those secrets could be exfiltrate...
PT-2025-10628
Name of the Vulnerable Software and Affected Versions Vela versions prior to 0.25.3 Vela versions prior to 0.26.3 Description The issue allows an attacker to transfer ownership of a repository and its secrets to a separate repository by spoofing a webhook payload with specific headers and body...
BIT-GITLAB-2022-4255
An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user email id through webhook payload...
CVE-2023-41937
Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 both inclusive trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by...
CVE-2023-41937
Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 both inclusive trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by...
CVE-2023-41937
CVE-2023-41937 affects the Jenkins Bitbucket Push and Pull Request Plugin versions 2.4.0–2.8.3 (inclusive). The vulnerability arises because the plugin trusts values in the webhook payload (including certain URLs) and uses configured Bitbucket credentials to connect to those URLs, enabling an att...
CVE-2023-41937: Server-Side Request Forgery (SSRF)
Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 both inclusive trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by...
PT-2023-28175
Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Push and Pull Request Plugin versions 2.4.0 through 2.8.3 Description The issue allows attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload. This is possible because the plugin...
