Jenkins

Gitlab

6 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2025-24397

  • EPSS 0.2%
  • Veröffentlicht 22.01.2025 17:15:13
  • Zuletzt bearbeitet 03.10.2025 00:19:00

An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credential IDs of GitLab API token and Secret...

5.3

CVE-2022-43411

  • EPSS 0.35%
  • Veröffentlicht 19.10.2022 16:15:10
  • Zuletzt bearbeitet 08.05.2025 20:15:27

Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.

5.4

CVE-2022-34777

  • EPSS 30.46%
  • Veröffentlicht 30.06.2022 18:15:09
  • Zuletzt bearbeitet 21.11.2024 07:10:09

Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission...

6.5

CVE-2022-30955

  • EPSS 0.81%
  • Veröffentlicht 17.05.2022 15:15:09
  • Zuletzt bearbeitet 21.11.2024 07:03:37

Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

8

CVE-2019-10300

  • EPSS 0.09%
  • Veröffentlicht 18.04.2019 17:29:00
  • Zuletzt bearbeitet 21.11.2024 04:18:50

A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers to connect to an attacker-specified URL using attacker-specified credential...

8.8

CVE-2019-10301

  • EPSS 0.07%
  • Veröffentlicht 18.04.2019 17:29:00
  • Zuletzt bearbeitet 21.11.2024 04:18:50

A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specifi...