Jenkins Project Jenkins Gitee Plugin vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Jenkins Project Jenkins Gitee Plugin: 4 record(s), with affected versions and fixes.
CVE-2026-92140
Medium · 6.8
CWE-79 Sep 16, 2026
Cross-site Scripting (XSS) in Jenkins Project Jenkins Gitee Plugin
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint.
CVE-2026-57293
Medium · 4.3
CWE-862 Jun 24, 2026
Missing Authorization in Jenkins Project Jenkins Gitee Plugin
An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2026-57292
Medium · 5.4
CWE-352 Jun 24, 2026
Cross-Site Request Forgery (CSRF) in Jenkins Project Jenkins Gitee Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
CVE-2026-57291
Medium · 5.4
CWE-862 Jun 24, 2026
Missing Authorization in Jenkins Project Jenkins Gitee Plugin
Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.