Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: Jenkins Component: Github Branch Source Clear all filters
TI-2026-41222 CVE-2026-57285 · GHSA-g7c6-wxjf-8564

Missing authorization in Jenkins GitHub Branch Source Plugin

Priority LOW 20

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00281 Published 2026-06-24 Partial fix · 1967.1970 CWE-862
TI-2026-30805 CVE-2026-42522 · GHSA-wg26-8wmj-cf9p

Missing authorization in Jenkins GitHub Branch Source Plugin

Priority LOW 19

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub Ap…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00184 Published 2026-04-29 Fixed in 1967.1969.v205fd594c821 CWE-862
TI-2024-15891 CVE-2024-23903 · GHSA-f67f-2j6r-m4c9

Incorrect comparison in Jenkins GitLab Branch Source Plugin

Priority LOW 31

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.005 Published 2024-01-24 Fixed in 688.v5fa CWE-697
TI-2024-15890 CVE-2024-23902 · GHSA-8r93-59cf-358f

Cross-site request forgery in Jenkins GitLab Branch Source Plugin

Priority LOW 20

A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00323 Published 2024-01-24 Fixed in 688.v5fa CWE-352
TI-2024-15889 CVE-2024-23901 · GHSA-fw9h-cxx9-gfq3

Information disclosure in Jenkins GitLab Branch Source Plugin

Priority LOW 35

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00458 Published 2024-01-24 Fixed in 688.v5fa CWE-200
TI-2018-15834 CVE-2018-1000185 · GHSA-9cfq-v2hm-c3xr

A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin…

Priority LOW 21

A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specif…

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00642 Published 2018-06-05 Fixed in 2.3.5 CWE-918