TI-2024-37285 CVE-2024-56324
GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins
Priority LOW 13
GoCD is a continuous deliver server.
Vulnerabilities
23 records
TI-2024-37283 CVE-2024-56322
GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality
Priority LOW 12
GoCD is a continuous deliver server.
TI-2024-37282 CVE-2024-56321
GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access
Priority LOW 19
GoCD is a continuous deliver server.
TI-2024-37281 CVE-2024-56320
GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user
Priority MEDIUM 44
GoCD is a continuous deliver server.
TI-2024-19065 CVE-2024-28866
GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-up
Priority LOW 28
GoCD is a continuous delivery server.
TI-2023-13148 CVE-2023-28629
Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd
Priority LOW 25
GoCD is an open source continuous delivery server.
TI-2023-13149 CVE-2023-28630
Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd
Priority LOW 20
GoCD is an open source continuous delivery server.
Priority MEDIUM 46
GoCD is a continuous delivery server.
Priority LOW 30
GoCD is a continuous delivery server.
TI-2022-18685 CVE-2022-39309
GoCD server secret encryption/decryption key leaked to agents during material serialization
Priority LOW 31
GoCD is a continuous delivery server.
TI-2022-18684 CVE-2022-39308
GoCD API authentication of user access tokens subject to timing attack during comparison
Priority LOW 30
GoCD is a continuous delivery server.
TI-2022-16511 CVE-2022-36088
GoCD Windows installations outside default location inadequately restrict installation file permissions
Priority LOW 24
GoCD is a continuous delivery server.
TI-2022-11727 CVE-2022-29184
Command Injection/Argument Injection in GoCD
Priority MEDIUM 46
GoCD is a continuous delivery server.
TI-2022-11726 CVE-2022-29183
Reflected XSS in GoCD
Priority LOW 29
GoCD is a continuous delivery server.
TI-2022-11725 CVE-2022-29182
DOM-based XSS in GoCD
Priority LOW 26
GoCD is a continuous delivery server.
TI-2021-19281 CVE-2021-43286 · GHSA-qw79-44j4-pg72
An issue was discovered in ThoughtWorks GoCD before 21.3.0.
Priority MEDIUM 43
An issue was discovered in ThoughtWorks GoCD before 21.3.0.
TI-2021-19283 CVE-2021-43288 · GHSA-m647-73w5-9fcf
An issue was discovered in ThoughtWorks GoCD before 21.3.0.
Priority LOW 26
An issue was discovered in ThoughtWorks GoCD before 21.3.0.
TI-2021-19284 CVE-2021-43289 · GHSA-522c-r5fp-4rxh
An issue was discovered in ThoughtWorks GoCD before 21.3.0.
Priority LOW 37
An issue was discovered in ThoughtWorks GoCD before 21.3.0.
TI-2021-19285 CVE-2021-43290 · GHSA-jm88-6p2m-7qr7
An issue was discovered in ThoughtWorks GoCD before 21.3.0.
Priority MEDIUM 48
An issue was discovered in ThoughtWorks GoCD before 21.3.0.
TI-2021-19282 CVE-2021-43287 · GHSA-4x25-wq2v-85f9
An issue was discovered in ThoughtWorks GoCD before 21.3.0.
Priority MEDIUM 55
An issue was discovered in ThoughtWorks GoCD before 21.3.0.
TI-2022-08645 CVE-2022-24832
Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames
Priority MEDIUM 41
GoCD is an open source a continuous delivery server.
TI-2021-20193 CVE-2021-44659 · GHSA-jf2m-jhcf-5xqg
Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be…
Priority MEDIUM 47
Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery (SSRF).
TI-2021-07934 CVE-2021-25924 · GHSA-997w-mjqx-37fq
Cross-site request forgery in gocd
Priority LOW 39
In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint.