gocd.

GoCD is vulnerable to authorization bypass via pipeline structure API

• gocd
• Broken access control

GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API

• gocd
• Broken access control

GoCD is vulnerable to historical server configuration API authorization bypass

• gocd
• Broken access control

GoCD is vulnerable to credential exposure when admins insecurely configure material URLs

• gocd
• Information disclosure
• Hard-coded credentials

GoCD is vulnerable to authorization bypass via material connection test APIs

• gocd
• Broken access control

GoCD is vulnerable to pipeline template view API authorization bypass

• gocd
• Broken access control

GoCD is vulnerable to authorization bypass via support process list API

• gocd
• Broken access control

GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages

• gocd
• Cross-site scripting (XSS)

GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages

• gocd
• Cross-site scripting (XSS)

GoCD before 26.1.0 is vulnerable to authorization bypass via job status API

• gocd
• Broken access control

GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins

• gocd
• XML external entities (XXE)

GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality

• gocd
• XML external entities (XXE)

GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access

• gocd
• Path traversal
• CWE-20

GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user

• gocd
• Broken access control

GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-up

• gocd
• Cross-site scripting (XSS)

Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd

• gocd
• Cross-site scripting (XSS)

Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd

• gocd
• Information disclosure

Compromised agents may be able to execute remote code on GoCD Server

• gocd
• Insecure deserialization

Malicious agent may be able to impersonate another agent in GoCD

• gocd
• Broken access control

GoCD server secret encryption/decryption key leaked to agents during material serialization

• gocd
• Information disclosure
• CWE-499

GoCD API authentication of user access tokens subject to timing attack during comparison

• gocd
• CWE-208
• CWE-1254

GoCD Windows installations outside default location inadequately restrict installation file permissions

• gocd
• Privilege escalation
• Broken access control

Command Injection/Argument Injection in GoCD

• gocd
• Command injection

Reflected XSS in GoCD

• gocd
• Cross-site scripting (XSS)

DOM-based XSS in GoCD

• gocd
• Cross-site scripting (XSS)

Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames

• gocd
• Other injection

gocd: In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to…

• gocd