Jenkins Gogs Plugin (Jenkins Project) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2023-10-25. Vendor: Jenkins Project.

CVEs of Jenkins Gogs Plugin

• CVE-2023-46657 - CVSS 5.3 (medium), 2023-10-25: Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal,…
• CVE-2023-40349 - CVSS 5.3 (medium), 2023-08-16: Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds…
• CVE-2023-40348 - CVSS 5.3 (medium), 2023-08-16: The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output.
• CVE-2019-10348 - CVSS 8.8 (high), 2019-07-11: Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read…