Github Branch Source vulnerabilitiesRanked by how likely they are to be used.
Github Branch Source is made by Jenkins. We track 6 published vulnerabilities in it, across 44 versions. None of them is on the list of flaws known to be exploited today. If you run Github Branch Source, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Github Branch Source vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Github Branch Source's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Github Branch Source flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 0.8%CVE-2017-1000087Medium
GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use.
- 0.6%CVE-2018-1000185Medium
A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a...
- 0.6%CVE-2017-1000091Medium
GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g.
- 0.5%CVE-2024-23903Medium
Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers...
- 0.5%CVE-2024-23901Medium
Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting...
- 0.3%CVE-2024-23902Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL.
Running Github Branch Source? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.
- Matched to
- Github Branch Source on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 6 published vulnerabilities listed under the name Github Branch Source, across 44 versions.
None of Github Branch Source's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Github Branch Source. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.