CVE-2022-36885

CVE-2022-36885 affects Jenkins GitHub Plugin 1.34.4 and earlier. The vulnerability arises from a non-constant time comparison when verifying webhook signatures, enabling attackers to use statistical methods to forge a valid webhook signature. Impact is limited to systems using the vulnerable plug...

CVE-2018-1000600

The Jenkins GitHub Plugin (version 1.29.1 and earlier) is vulnerable to a Server-Side Request Forgery (SSRF) and exposure of sensitive information in the GitHubTokenCredentialsCreator.java file. The root cause is a failure to properly detect access rights, allowing an attacker to use attacker-spe...

CVE-2023-46650

The CVE-2023-46650 entry corresponds to a stored XSS vulnerability in Jenkins GitHub Plugin versions up to 1.37.3. The root cause is that the plugin does not escape the GitHub project URL on the build page when showing changes, enabling stored XSS attacks. Exploitation is possible by attackers wi...

CVE-2018-1000183

The CVE-2018-1000183 entry describes an information disclosure in the Jenkins GitHub Plugin (versions 1.29.0 and earlier) via GitHubServerConfig.java. Attackers with Overall/Read access could connect to an attacker-specified URL using attacker-specified credentials IDs, causing credentials stored...

CVE-2018-1000184

The CVE refers to a server-side request forgery in the Jenkins GitHub Plugin (versions ≤ 1.29.0) where the vulnerable code GitHubPluginConfig.java allows an attacker with Overall/Read access to trigger Jenkins to issue a GET request to an arbitrary URL. This SSRF impact is documented across multi...

CVE-2026-42523

The Jenkins GitHub Plugin (versions 1.46.0 and earlier) contains a stored cross-site scripting (XSS) vulnerability. The root cause is the improper processing of the current job URL within the JavaScript used to validate the "GitHub hook trigger for GITScm polling" feature. This flaw allows non-an...