Jenkins Gogs
4 CVEs affecting Jenkins Gogs. Latest disclosed: 2023-10-25. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10348 | High | 8.8 | 2019-07-11 | Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permissio… |
CVE-2023-46657 | Medium | 5.3 | 2023-10-25 | Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, po… |
CVE-2023-40349 | Medium | 5.3 | 2023-08-16 | Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of… |
CVE-2023-40348 | Medium | 5.3 | 2023-08-16 | The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output. |