Server-side Request Forgery (SSRF)

github.com/gogs/gogs is vulnerable to server-side request forgery. The vulnerability exists because the isLocalHostname function of webhook.go does not properly validate the IP addresses before redirect, allowing an attacker to gain access to response data by making an HTTP request to untrusted U...

PT-2022-13774

Name of the Vulnerable Software and Affected Versions gogs/gogs versions prior to 0.12.8 Description The issue is related to a Server-Side Request Forgery SSRF in the GitHub repository gogs/gogs. This allows a malicious user to discover services in the internal network through webhook...

org.jenkins-ci.plugins:bitbucket-pullrequest-builder (>=1.4.29, <=1.5.0), org.jenkins-ci.plugins:coding-webhook (>=1.0.0, <=1.4.3) +3 more potentially affected by CVE-2021-21684 via org.jenkins-ci.plugins:git (2.4.1)

org.jenkins-ci.plugins:git MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:bitbucket-pullrequest-builder =1.4.29, =1.0.0, =1.0.11, =1.1.29, =2.4.0, =2.4.1 Sour...

org.jenkins-ci.plugins:gogs-webhook (>=1.0.0, <=1.0.15) potentially affected by CVE-2021-21684 via org.jenkins-ci.plugins:git (2.2.5)

org.jenkins-ci.plugins:git MAVEN version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:gogs-webhook =1.0.0, =1.0.15 Source cves: CVE-2021-21684 Source advisory:...

XXE vulnerability in Jenkins Generic Webhook Trigger Plugin

Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with the ability to call webhooks configured to extract parameters using XPath to have Jenkins parse a crafted XML request body that uses...

GHSA-732F-W585-GMPC XXE vulnerability in Jenkins Generic Webhook Trigger Plugin

Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with the ability to call webhooks configured to extract parameters using XPath to have Jenkins parse a crafted XML request body that uses...

Credentials stored in plain text by Jenkins tfs Plugin

tfs Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file hudson.plugins.tfs.TeamPluginGlobalConfig.xml on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with access to the Jenkins controller file system...

GHSA-W6C2-JRHH-JRXG Credentials stored in plain text by Jenkins tfs Plugin

tfs Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file hudson.plugins.tfs.TeamPluginGlobalConfig.xml on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with access to the Jenkins controller file system...

GHSA-JP57-4X34-5V94 Mattermost Server is vulnerable to webhook and slash command manipulation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API...

Mattermost Server has mishandled webhook access control

An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case...

org.jenkins-ci.plugins:bitbucket-pullrequest-builder (>=1.4.29, <=1.5.0), org.jenkins-ci.plugins:coding-webhook (>=1.0.0, <=1.4.3) +3 more potentially affected by CVE-2020-2136 via org.jenkins-ci.plugins:git (2.4.1)

org.jenkins-ci.plugins:git MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:bitbucket-pullrequest-builder =1.4.29, =1.0.0, =1.0.11, =1.1.29, =2.4.0, =2.4.1 Sour...

org.jenkins-ci.plugins:gogs-webhook (>=1.0.0, <=1.0.15) potentially affected by CVE-2020-2136 via org.jenkins-ci.plugins:git (2.2.5)

org.jenkins-ci.plugins:git MAVEN version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:gogs-webhook =1.0.0, =1.0.15 Source cves: CVE-2020-2136 Source advisory:...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the rest.AnonymousClientConfig method that does not effectively clear service account credentials loaded using rest.InClusterConfig. An attacker can gain...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the rest.AnonymousClientConfig method that does not effectively clear service account credentials loaded using rest.InClusterConfig. An attacker can gain...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the rest.AnonymousClientConfig method that does not effectively clear service account credentials loaded using rest.InClusterConfig. An attacker can gain...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the rest.AnonymousClientConfig method that does not effectively clear service account credentials loaded using rest.InClusterConfig. An attacker can gain...

Jenkins Round Corner Plugin跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Jenkins Rundeck Plugin 3.6.10 and earlier versions have a cross-site scripting...

org.jenkins-ci.plugins:gogs-webhook (>=1.0.0, <=1.0.15) potentially affected by CVE-2022-30949 via org.jenkins-ci.plugins:git (2.2.5)

org.jenkins-ci.plugins:git MAVEN version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:gogs-webhook =1.0.0, =1.0.15 Source cves: CVE-2022-30949 Source advisory:...

GHSA-4M42-8QFQ-H3Q9 Cross-site Scripting in Jenkins Rundeck Plugin

Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads. Rundeck Plugin 3.6.11 sanitizes URLs submitted in Rundeck...

Cross-site Scripting in Jenkins Rundeck Plugin

Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads. Rundeck Plugin 3.6.11 sanitizes URLs submitted in Rundeck...