Thoughtworks Gocd vulnerabilities

• gocd GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins CVE-2024-56324 2.1 LowJanuary 3, 2025
• gocd GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality CVE-2024-56322 2.1 LowJanuary 3, 2025
• gocd GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access CVE-2024-56321 3.8 LowJanuary 3, 2025
• gocd GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user CVE-2024-56320 9.4 CriticalJanuary 3, 2025
• gocd GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-up CVE-2024-28866 3.1 LowMay 13, 2024
• gocd Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd CVE-2023-28629 5.4 MediumMarch 27, 2023
• gocd Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd CVE-2023-28630 4.2 MediumMarch 27, 2023
• gocd Compromised agents may be able to execute remote code on GoCD Server CVE-2022-39311 9.1 CriticalOctober 14, 2022
• gocd Malicious agent may be able to impersonate another agent in GoCD CVE-2022-39310 4.9 MediumOctober 14, 2022
• gocd GoCD server secret encryption/decryption key leaked to agents during material serialization CVE-2022-39309 4.9 MediumOctober 14, 2022
• gocd GoCD API authentication of user access tokens subject to timing attack during comparison CVE-2022-39308 6.5 MediumOctober 14, 2022
• gocd GoCD Windows installations outside default location inadequately restrict installation file permissions CVE-2022-36088 5.0 MediumSeptember 7, 2022
• gocd Command Injection/Argument Injection in GoCD CVE-2022-29184 8.8 HighMay 20, 2022
• gocd Reflected XSS in GoCD CVE-2022-29183 4.3 MediumMay 20, 2022
• gocd DOM-based XSS in GoCD CVE-2022-29182 4.3 MediumMay 20, 2022
• thoughtworks gocd An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create... CVE-2021-43286 8.8 HighApril 14, 2022
• thoughtworks gocd An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD... CVE-2021-43288 5.4 MediumApril 14, 2022
• thoughtworks gocd An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a... CVE-2021-43289 7.5 HighApril 14, 2022
• thoughtworks gocd An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a... CVE-2021-43290 9.8 CriticalApril 14, 2022
• thoughtworks gocd An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which... CVE-2021-43287 Public exploit EPSS 27.4% 7.5 HighApril 14, 2022
• gocd Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames CVE-2022-24832 8.2 HighApril 11, 2022
• thoughtworks gocd Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to... CVE-2021-44659 Disputed 9.8 CriticalDecember 22, 2021
• gocd In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing... CVE-2021-25924 8.8 HighApril 1, 2021