io.jenkins.plugins:bitbucket-push-and-pull-request

2 results · Feed

• Medium 4.8
  CVE-2026-57289

  Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation

  Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers a…

  Jenkins Project Jenkins Bitbucket Push and Pull Request Plugin io.jenkins.plugins:bitbucket-push-and-pull-request Web / CMS Maven
  Jun 24, 2026
• High 7.5
  CVE-2023-41937

  SSRF vulnerability in Jenkins Bitbucket Push and Pull Request Plugin allows capturing credentials

  Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbuc…

  Jenkins Project Jenkins Bitbucket Push and Pull Request Plugin io.jenkins.plugins:bitbucket-push-and-pull-request Web / CMS Maven
  Sep 6, 2023