Archive
25 October 2023
Vulnerabilities first published on this day (UTC), newest first.
6 results · Clear filters · Feed
-
Low 3.7
Non-constant time webhook token hash comparison in Jenkins Zanata Plugin
Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.
-
Low 3.7
Jenkins MSTeams Webhook Trigger Plugin uses non-constant time webhook token comparison
Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook …
-
Low 3.7
Jenkins Gogs Plugin uses non-constant time webhook token comparison
Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.
-
Low 3.7
Jenkins Multibranch Scan Webhook Trigger Plugin uses non-constant time webhook token comparison
Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid…
-
Low 2.7
Jenkins lambdatest-automation Plugin may expose Credentials access token
Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure.
-
Low 2.6
User Attribute Disclosure via DynamoDB Data Stores
When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request