{"vulnerability": "CVE-2022-4342", "sightings": [{"uuid": "c71e1314-2afa-4459-9be4-00ab14d180ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43425", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3m26bok3cefj2", "content": "", "creation_timestamp": "2025-10-02T00:17:51.478734Z"}, {"uuid": "33b3273f-01b1-42c5-85b9-8427a7656e37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43425", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3m26bpanxqa2t", "content": "", "creation_timestamp": "2025-10-02T00:17:52.357925Z"}, {"uuid": "0a9479f8-2dd7-44b7-ae74-e06d7bf6e5ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43424", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/15627", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-43424\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.\n\ud83d\udccf Published: 2022-10-19T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-08T20:43:52.024Z\n\ud83d\udd17 References:\n1. https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2627\n2. http://www.openwall.com/lists/oss-security/2022/10/19/3", "creation_timestamp": "2025-05-08T21:25:40.000000Z"}, {"uuid": "520b34e2-0686-44be-9915-edbaa003ea7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43428", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/15597", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-43428\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.\n\ud83d\udccf Published: 2022-10-19T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-08T19:01:35.549Z\n\ud83d\udd17 References:\n1. https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2624\n2. http://www.openwall.com/lists/oss-security/2022/10/19/3", "creation_timestamp": "2025-05-08T19:24:18.000000Z"}, {"uuid": "b6cbb683-b87d-4979-8e1d-34ebb7f6af96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43425", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/15591", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-43425\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Jenkins Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of Custom Checkbox Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.\n\ud83d\udccf Published: 2022-10-19T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-08T19:07:32.786Z\n\ud83d\udd17 References:\n1. https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2797\n2. http://www.openwall.com/lists/oss-security/2022/10/19/3", "creation_timestamp": "2025-05-08T19:24:09.000000Z"}, {"uuid": "0cbd9e25-3d64-4bf4-8239-6698748f7dd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43429", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/15599", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-43429\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.\n\ud83d\udccf Published: 2022-10-19T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-08T19:00:14.372Z\n\ud83d\udd17 References:\n1. https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2624\n2. http://www.openwall.com/lists/oss-security/2022/10/19/3", "creation_timestamp": "2025-05-08T19:24:20.000000Z"}, {"uuid": "c8ec14e9-b7b5-4706-be3b-4cc7b16ecc24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43428", "type": "seen", "source": "https://t.me/cibsecurity/51795", "content": "\u203c CVE-2022-43428 \u203c\n\nJenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-19T20:15:18.000000Z"}, {"uuid": "9ede4c17-22ed-41eb-a52c-dce7737e4ea9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43427", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/15594", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-43427\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.\n\ud83d\udccf Published: 2022-10-19T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-08T19:05:30.277Z\n\ud83d\udd17 References:\n1. https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2623\n2. http://www.openwall.com/lists/oss-security/2022/10/19/3", "creation_timestamp": "2025-05-08T19:24:12.000000Z"}, {"uuid": "605def56-297f-463b-a760-d843378d9135", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43426", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/15593", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-43426\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture it.\n\ud83d\udccf Published: 2022-10-19T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-08T19:06:41.416Z\n\ud83d\udd17 References:\n1. https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2480\n2. http://www.openwall.com/lists/oss-security/2022/10/19/3", "creation_timestamp": "2025-05-08T19:24:11.000000Z"}, {"uuid": "ff5efb00-a345-43fb-95fc-62e5061de163", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-4342", "type": "seen", "source": "https://t.me/cibsecurity/61511", "content": "\u203c CVE-2023-0838 \u203c\n\nAn issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-06T00:26:37.000000Z"}, {"uuid": "8e35777e-eb7a-4150-a452-532f4d7e4b25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-4342", "type": "seen", "source": "https://t.me/cibsecurity/56404", "content": "\u203c CVE-2022-4342 \u203c\n\nAn issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak masked webhook secrets by changing target URL of the webhook.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-01-12T07:29:54.000000Z"}, {"uuid": "bc2bc20e-e984-4861-a933-8f2fb3c2d204", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43426", "type": "seen", "source": "https://t.me/cibsecurity/51802", "content": "\u203c CVE-2022-43426 \u203c\n\nJenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture it.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-19T20:15:26.000000Z"}, {"uuid": "49082806-dfa8-4bb1-b3f3-93b66937af78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43420", "type": "seen", "source": "https://t.me/cibsecurity/51799", "content": "\u203c CVE-2022-43420 \u203c\n\nJenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control or modify Contrast service API responses.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-19T20:15:22.000000Z"}, {"uuid": "a318e7d5-2f06-4ece-8a11-df9187dc1b21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43424", "type": "seen", "source": "https://t.me/cibsecurity/51812", "content": "\u203c CVE-2022-43424 \u203c\n\nJenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-19T20:15:38.000000Z"}, {"uuid": "2f4a204e-9976-4be7-bc51-fe7caf88f869", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43427", "type": "seen", "source": "https://t.me/cibsecurity/51807", "content": "\u203c CVE-2022-43427 \u203c\n\nJenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-19T20:15:31.000000Z"}, {"uuid": "9fa29fdc-7cd7-47a3-87ed-a2e64b2b5a25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43422", "type": "seen", "source": "https://t.me/cibsecurity/51806", "content": "\u203c CVE-2022-43422 \u203c\n\nJenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-19T20:15:30.000000Z"}]}