Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.jenkins-ci.plugins:gogs-webhook

4 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4
Registry
Maven Central

Advisories 4

  • Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected…

    Affected: through 1.0.15.

  • Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers…

    Affected: through 1.0.15.

  • The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs…

    Affected: through 1.0.15.

  • Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with…

    Affected: fixed in 1.0.15.