Lack of authentication mechanism for webhook in xpdev

xpdev provides a webhook endpoint at /xpdev-webhook that can be used to trigger builds configured to use a specified repository. In xpdev 1.0 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attackers to trigger builds of jobs corresponding to an...

com.cloudbees.jenkins.plugins:xpdev (1.0) potentially affected by CVE-2022-43410 via org.jenkins-ci.plugins:mercurial (1.41)

org.jenkins-ci.plugins:mercurial MAVEN version 1.41 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:mercurial and may be impacted: - com.cloudbees.jenkins.plugins:xpdev 1.0 Source cves: CVE-2022-43410 Source advisory:...

com.cloudbees.jenkins.plugins:xpdev (1.0) potentially affected by CVE-2021-21698 via org.jenkins-ci.plugins:subversion (1.40)

org.jenkins-ci.plugins:subversion MAVEN version 1.40 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - com.cloudbees.jenkins.plugins:xpdev 1.0 Source cves: CVE-2021-21698 Source advisory:...

com.cloudbees.jenkins.plugins:xpdev (1.0) potentially affected by CVE-2020-2304 via org.jenkins-ci.plugins:subversion (1.40)

org.jenkins-ci.plugins:subversion MAVEN version 1.40 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - com.cloudbees.jenkins.plugins:xpdev 1.0 Source cves: CVE-2020-2304 Source advisory:...

com.cloudbees.jenkins.plugins:xpdev (1.0) potentially affected by CVE-2020-2305 via org.jenkins-ci.plugins:mercurial (1.41)

org.jenkins-ci.plugins:mercurial MAVEN version 1.41 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:mercurial and may be impacted: - com.cloudbees.jenkins.plugins:xpdev 1.0 Source cves: CVE-2020-2305 Source advisory:...

com.cloudbees.jenkins.plugins:xpdev (1.0) potentially affected by CVE-2020-2111 via org.jenkins-ci.plugins:subversion (1.40)

org.jenkins-ci.plugins:subversion MAVEN version 1.40 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - com.cloudbees.jenkins.plugins:xpdev 1.0 Source cves: CVE-2020-2111 Source advisory:...

com.cloudbees.jenkins.plugins:xpdev (1.0), com.cloudbees.plugins:build-flow-plugin (0.4) +50 more potentially affected by CVE-2019-10354 via org.jenkins-ci.main:jenkins-core (1.447)

org.jenkins-ci.main:jenkins-core MAVEN version 1.447 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:xpdev 1.0 - com.cloudbees.plugins:build-flow-plugin 0.4 -...

com.cloudbees.jenkins.plugins:xpdev (1.0) potentially affected by CVE-2022-30949 via org.jenkins-ci.plugins:mercurial (1.41)

org.jenkins-ci.plugins:mercurial MAVEN version 1.41 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:mercurial and may be impacted: - com.cloudbees.jenkins.plugins:xpdev 1.0 Source cves: CVE-2022-30949 Source advisory:...

com.cloudbees.jenkins.plugins:xpdev (1.0) potentially affected by CVE-2022-30947 via org.jenkins-ci.plugins:mercurial (1.41)

org.jenkins-ci.plugins:mercurial MAVEN version 1.41 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:mercurial and may be impacted: - com.cloudbees.jenkins.plugins:xpdev 1.0 Source cves: CVE-2022-30947 Source advisory:...

com.cloudbees.jenkins.plugins:xpdev (1.0) potentially affected by CVE-2017-1000085 via org.jenkins-ci.plugins:subversion (1.40)

org.jenkins-ci.plugins:subversion MAVEN version 1.40 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - com.cloudbees.jenkins.plugins:xpdev 1.0 Source cves: CVE-2017-1000085 Source advisory:...

com.cloudbees.jenkins.plugins:xpdev (1.0) potentially affected by CVE-2022-29046 via org.jenkins-ci.plugins:subversion (1.40)

org.jenkins-ci.plugins:subversion MAVEN version 1.40 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - com.cloudbees.jenkins.plugins:xpdev 1.0 Source cves: CVE-2022-29046 Source advisory:...