GHSA-2482-GR3V-F3F3 Jenkins Fogbugz Plugin has missing permissions check

Jenkins Fogbugz Plugin provides a webhook endpoint at /fbTrigger/ that can be used to trigger builds of any jobs. In Fogbugz Plugin 2.2.17 and earlier, this endpoint can be accessed by attackers with Item/Read permission, allowing them to trigger builds of jobs specified in a jobname request...

Jenkins Assembla merge request builder Plugin missing authentication to access endpoint

Jenkins Assembla merge request builder Plugin provides a webhook endpoint at /assembla-webhook/ that can be used to trigger builds of jobs configured to use a specified repository. In Assembla merge request builder Plugin 1.1.13 and earlier, this endpoint can be accessed without authentication...

Jenkins Fogbugz Plugin has missing permissions check

Jenkins Fogbugz Plugin provides a webhook endpoint at /fbTrigger/ that can be used to trigger builds of any jobs. In Fogbugz Plugin 2.2.17 and earlier, this endpoint can be accessed by attackers with Item/Read permission, allowing them to trigger builds of jobs specified in a jobname request...

GHSA-JR86-6J4J-MV45 Jenkins Assembla merge request builder Plugin missing authentication to access endpoint

Jenkins Assembla merge request builder Plugin provides a webhook endpoint at /assembla-webhook/ that can be used to trigger builds of jobs configured to use a specified repository. In Assembla merge request builder Plugin 1.1.13 and earlier, this endpoint can be accessed without authentication...

Lack of authentication mechanism in Jenkins TurboScript Plugin webhook

A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository...

GHSA-7GQC-Q9MC-6348 Lack of authentication mechanism in Jenkins TurboScript Plugin webhook

A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository...

CVE-2023-30520

Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads...

PT-2023-22746 · Jenkins · Jenkins Quay.Io Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Quay.io trigger Plugin versions 0.1 and earlier Description: A missing permission check in the Jenkins Quay.io trigger Plugin allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repositor...

Lack of authentication mechanism in quayio-trigger webhook

quayio-trigger provides a webhook endpoint at /quayio-webhook/ that can be used to trigger builds of jobs configured to use a specified repository. In quayio-trigger 0.1 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attackers to trigger builds of...

Lack of authentication mechanism in spoonscript webhook

spoonscript provides a webhook endpoint at /turbo-webhook/ that can be used to trigger builds of jobs configured to use a specified repository. In spoonscript 1.3 and earlier, this endpoint can be accessed by attackers with Item/Read permission to trigger builds of jobs corresponding to the...

PT-2023-22750 · Jenkins · Jenkins Fogbugz Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Fogbugz Plugin versions 2.2.17 and earlier Description: A missing permission check in the Jenkins Fogbugz Plugin allows attackers with Item/Read permission to trigger builds of jobs specified in a jobname request parameter. The plugin...

Lack of authentication mechanism in assembla-merge-request-builder webhook

assembla-merge-request-builder provides a webhook endpoint at /assembla-webhook/ that can be used to trigger builds of jobs configured to use a specified repository. In assembla-merge-request-builder 1.1.13 and earlier, this endpoint can be accessed without authentication. This allows...

Stored XSS vulnerability in quayio-trigger

quayio-trigger 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads. As of publication of thi...

Lack of authentication mechanism in fogbugz webhook

fogbugz provides a webhook endpoint at /fbTrigger/ that can be used to trigger builds of any jobs. In fogbugz 2.2.17 and earlier, this endpoint can be accessed by attackers with Item/Read permission, allowing them to trigger builds of jobs specified in a jobname request parameter. As of publicati...

CVE-2023-30520: Improper Neutralization of Input During Web Page Generation

Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads...

CVE-2023-0838

An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342...

UBUNTU-CVE-2023-0838

An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342...

Design/Logic Flaw

An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342...

CVE-2023-0838: Exposure of Sensitive Information to an Unauthorized Actor

An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342...

PT-2023-16560 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 15.1 through 15.8.4 GitLab versions 15.9 through 15.9.3 GitLab versions 15.10 through 15.10.0 Description: An issue in GitLab allows a maintainer to modify a webhook URL, potentially leaking masked webhook secrets by adding a...