gocd

Records34All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

gocd records in CISA KEV

No gocd vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Gocd 23 records MEDIUM Node-worker-threads-pool 1 record MEDIUM

Records

34 records

TI-2021-09947 CVE-2021-29057 · GHSA-7vxc-q7rv-qfj8

An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version…

MEDIUM 62

An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00586 Published 2023-08-11 No fix listed CWE-400

TI-2021-19282 CVE-2021-43287 · GHSA-4x25-wq2v-85f9

An issue was discovered in ThoughtWorks GoCD before 21.3.0.

MEDIUM 55

An issue was discovered in ThoughtWorks GoCD before 21.3.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.2736 Published 2022-04-14 No fix listed CWE-200

TI-2021-19285 CVE-2021-43290 · GHSA-jm88-6p2m-7qr7

An issue was discovered in ThoughtWorks GoCD before 21.3.0.

MEDIUM 48

An issue was discovered in ThoughtWorks GoCD before 21.3.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03219 Published 2022-04-14 No fix listed CWE-22

TI-2021-20193 CVE-2021-44659 · GHSA-jf2m-jhcf-5xqg

Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be…

MEDIUM 47

Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery (SSRF).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02606 Published 2021-12-22 No fix listed CWE-918

TI-2022-18687 CVE-2022-39311

Compromised agents may be able to execute remote code on GoCD Server

MEDIUM 46

GoCD is a continuous delivery server.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.02216 Published 2022-10-14 Fixed in 21.1.0 CWE-502

TI-2022-11727 CVE-2022-29184

Command Injection/Argument Injection in GoCD

MEDIUM 46

GoCD is a continuous delivery server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03632 Published 2022-05-20 Fixed in 22.1.0 CWE-77

TI-2024-37281 CVE-2024-56320

GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user

MEDIUM 44

GoCD is a continuous deliver server.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00737 Published 2025-01-03 Fixed in 24.5.0 CWE-285

TI-2021-19281 CVE-2021-43286 · GHSA-qw79-44j4-pg72

An issue was discovered in ThoughtWorks GoCD before 21.3.0.

MEDIUM 43

An issue was discovered in ThoughtWorks GoCD before 21.3.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02898 Published 2022-04-14 No fix listed CWE-77

TI-2022-08645 CVE-2022-24832

Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames

MEDIUM 41

GoCD is an open source a continuous delivery server.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.01695 Published 2022-04-11 Fixed in 22.1.0 CWE-74

TI-2021-07934 CVE-2021-25924 · GHSA-997w-mjqx-37fq

Cross-site request forgery in gocd

LOW 39

In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00751 Published 2021-04-01 No fix listed CWE-352

TI-2021-19284 CVE-2021-43289 · GHSA-522c-r5fp-4rxh

An issue was discovered in ThoughtWorks GoCD before 21.3.0.

LOW 37

An issue was discovered in ThoughtWorks GoCD before 21.3.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02345 Published 2022-04-14 No fix listed CWE-22

TI-2026-37859 CVE-2026-52741

GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages

LOW 34

GoCD is a continuous deliver server.

CVSS 4.0HIGH 7.5 Network Low privileges User interaction EPSS 0.00538 Published 2026-09-21 Fixed in 26.1.0 CWE-80

TI-2026-48459 CVE-2026-68919

GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages

LOW 31

GoCD is a continuous deliver server.

CVSS 4.0HIGH 7.0 Network Low privileges User interaction EPSS 0.00483 Published 2026-09-21 Fixed in 26.1.0 CWE-80

TI-2022-18685 CVE-2022-39309

GoCD server secret encryption/decryption key leaked to agents during material serialization

LOW 31

GoCD is a continuous delivery server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01064 Published 2022-10-14 Fixed in 21.1.0 CWE-200

TI-2022-18686 CVE-2022-39310

Malicious agent may be able to impersonate another agent in GoCD

LOW 30

GoCD is a continuous delivery server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00859 Published 2022-10-14 Fixed in 21.1.0 CWE-284

TI-2022-18684 CVE-2022-39308

GoCD API authentication of user access tokens subject to timing attack during comparison

LOW 30

GoCD is a continuous delivery server.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00868 Published 2022-10-14 Fixed in 19.11.0 CWE-1254

TI-2022-11726 CVE-2022-29183

Reflected XSS in GoCD

LOW 29

GoCD is a continuous delivery server.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00872 Published 2022-05-20 Fixed in 21.4.0 CWE-79

TI-2024-19065 CVE-2024-28866

GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-up

LOW 28

GoCD is a continuous delivery server.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00419 Published 2024-05-13 Fixed in 24.1.0 CWE-79

TI-2022-11725 CVE-2022-29182

DOM-based XSS in GoCD

LOW 26

GoCD is a continuous delivery server.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00856 Published 2022-05-20 Fixed in 22.1.0 CWE-79

TI-2021-19283 CVE-2021-43288 · GHSA-m647-73w5-9fcf

An issue was discovered in ThoughtWorks GoCD before 21.3.0.

LOW 26

An issue was discovered in ThoughtWorks GoCD before 21.3.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00912 Published 2022-04-14 No fix listed CWE-79

TI-2026-37862 CVE-2026-52744

GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API

LOW 25

GoCD is a continuous deliver server.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00583 Published 2026-09-23 Fixed in 26.1.0 CWE-862

TI-2026-37858 CVE-2026-52740

GoCD is vulnerable to pipeline template view API authorization bypass

LOW 25

GoCD is a continuous deliver server.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00583 Published 2026-09-21 Fixed in 26.1.0 CWE-863

TI-2023-13148 CVE-2023-28629

Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd

LOW 25

GoCD is an open source continuous delivery server.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00498 Published 2023-03-27 Fixed in 23.1.0 CWE-79

TI-2026-37860 CVE-2026-52742

GoCD is vulnerable to historical server configuration API authorization bypass

LOW 24

GoCD is a continuous deliver server.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.0071 Published 2026-09-21 Fixed in 26.1.0 CWE-863

TI-2022-16511 CVE-2022-36088

GoCD Windows installations outside default location inadequately restrict installation file permissions

LOW 24

GoCD is a continuous delivery server.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00231 Published 2022-09-07 Fixed in 22.2.0 CWE-269

Open these records in search →