Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2022-43410

jenkins-plugin/mercurial: Webhook endpoint discloses job names to unauthorized users in Mercurial Plugin

Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins Redhat
Products
Mercurial Ocp Tools
CVE-2022-30948

plugin: Mercurial SCM plugin can check out from the controller file system

Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Jenkins Redhat
Products
Mercurial Openshift
CVE-2020-2306

jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information disclosure

A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Jenkins Redhat
Products
Mercurial Openshift
CVE-2020-2305

jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks

Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Jenkins Redhat
Products
Mercurial Openshift
CVE-2018-1000112

jenkins-plugin-mercurial: Disclosure of user names and node names to unauthorized users through post-commit hook URL in Mercurial Plugin (SECURITY-726)

An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an attacker with network access to obtain a list of nodes and users.

CVSS 3.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins
Products
Mercurial