GI
Product
Git
11
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 4Medium 7Low 0
Watch
Add Git to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-36882 | 8.8 | Jul 27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git… Affected: through 4.11.3 |
| CVE-2022-36883 | 7.5 | Jul 27 | A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git… Affected: through 4.11.3 |
| CVE-2022-30947 | 7.5 | May 17 | Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local… Affected: before 4.11.2 |
| CVE-2017-1000092 | 7.5 | Oct 5 | Git Plugin connects to a user-specified Git repository as part of form validation Affected: 0.1.0; 0.2.0; 0.3.0; 0.4.0; 0.5.0; 0.6.0; +34 more |
| CVE-2022-38663 | 6.5 | Aug 23 | Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password… Affected: through 4.11.4 |
| CVE-2018-1000182 | 6.4 | Jun 5 | A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java,… Affected: through 3.9.0 |
| CVE-2021-21684 | 6.1 | Oct 6 | Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a… Affected: through 4.8.2 |
| CVE-2020-2136 | 5.4 | Mar 9 | Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting… Affected: through 4.2.0 |
| CVE-2022-36884 | 5.3 | Jul 27 | The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git… Affected: through 4.11.3 |
| CVE-2018-1000110 | 5.3 | Mar 13 | An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of… Affected: through 3.7.0 |
| CVE-2019-1003010 | 4.3 | Feb 6 | A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a… Affected: through 3.9.1 |
Showing 11