Thoughtworks - vulnerabilities (CVEs)
24 CVEs in 2 products, 0 in the last 30 days, newest from 2025-01-03.
Products
- Gocd - 23 CVEs
- Node-worker-threads-pool - 1 CVEs
Newest CVEs of Thoughtworks
- CVE-2024-56322 - CVSS 7.2 (high), 2025-01-03: GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse a hidden/unused configuration repository…
- CVE-2024-56321 - CVSS 3.8 (low), 2025-01-03: GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse the backup configuration "post-backup…
- CVE-2024-56320 - CVSS 9.4 (critical), 2025-01-03: GoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorization of access to the…
- CVE-2024-56324 - CVSS 7.1 (high), 2025-01-03: GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups…
- CVE-2024-28866 - CVSS 6.1 (medium), 2024-05-14: GoCD is a continuous delivery server. GoCD versions from 19.4.0 to 23.5.0 (inclusive) are potentially vulnerable to a reflected cross-site scripting…
- CVE-2021-29057 - CVSS 6.5 (medium), 2023-08-11: An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service.
- CVE-2023-28630 - CVSS 4.4 (medium), 2023-03-27: GoCD is an open source continuous delivery server. In GoCD versions from 20.5.0 and below 23.1.0, if the server environment is not correctly configured by…
- CVE-2023-28629 - CVSS 5.4 (medium), 2023-03-27: GoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with…
- CVE-2022-39311 - CVSS 9.1 (critical), 2022-10-14: GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD…
- CVE-2022-39310 - CVSS 6.5 (medium), 2022-10-14: GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD…
- CVE-2022-39309 - CVSS 6.5 (medium), 2022-10-14: GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD…
- CVE-2022-39308 - CVSS 6.5 (medium), 2022-10-14: GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD…
- CVE-2022-36088 - CVSS 5.5 (medium), 2022-09-07: GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict…
- CVE-2022-29184 - CVSS 8.8 (high), 2022-05-20: GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create…
- CVE-2022-29182 - CVSS 5.4 (medium), 2022-05-20: GoCD is a continuous delivery server. GoCD versions 19.11.0 through 21.4.0 (inclusive) are vulnerable to a Document Object Model (DOM)-based cross-site…
- CVE-2022-29183 - CVSS 6.1 (medium), 2022-05-20: GoCD is a continuous delivery server. GoCD versions 20.2.0 until 21.4.0 are vulnerable to reflected cross-site scripting via abuse of the pipeline comparison…
- CVE-2021-43288 - CVSS 5.4 (medium), 2022-04-14: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report.
- CVE-2021-43286 - CVSS 8.8 (high), 2022-04-14: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create a new pipeline on a GoCD server can abuse a command-line…
- CVE-2021-43290 - CVSS 9.8 (critical), 2022-04-14: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory of a…
- CVE-2021-43289 - CVSS 7.5 (high), 2022-04-14: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrary…
- CVE-2021-43287 - CVSS 7.5 (high), 2022-04-14: An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD…
- CVE-2022-24832 - CVSS 8.2 (high), 2022-04-11: GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape…
- CVE-2021-44659 - CVSS 9.8 (critical), 2021-12-22: Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side…
- CVE-2021-25924 - CVSS 8.8 (high), 2021-04-01: In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint. An…
