Skip to content
Noroxi

thoughtworks records

24 published records for vendor thoughtworks.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 21
  2. 22
  3. 23
  4. 24
  5. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

24 records
  • CVE-2021-43290
    40Plan

    An issue was discovered in ThoughtWorks GoCD before 21.3.0.

    CriticalCVSS 9.8No exploitEPSS 3%

    thoughtworks · gocdApr 14, 2022

  • CVE-2021-44659
    40Plan

    Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve

    CriticalCVSS 9.8No exploitEPSS 3%

    thoughtworks · gocdDec 22, 2021

  • CVE-2021-43287
    38Monitor

    An issue was discovered in ThoughtWorks GoCD before 21.3.0.

    HighCVSS 7.5Proof of conceptEPSS 27%

    thoughtworks · gocdApr 14, 2022

  • CVE-2024-56320
    37Monitor

    GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user

    CriticalCVSS 9.4No exploitEPSS 1%

    thoughtworks · gocdJan 3, 2025

  • CVE-2022-29184
    36Monitor

    Command Injection/Argument Injection in GoCD

    HighCVSS 8.8No exploitEPSS 4%

    thoughtworks · gocdMay 20, 2022

  • CVE-2021-43286
    36Monitor

    An issue was discovered in ThoughtWorks GoCD before 21.3.0.

    HighCVSS 8.8No exploitEPSS 3%

    thoughtworks · gocdApr 14, 2022

  • CVE-2022-39311
    36Monitor

    Compromised agents may be able to execute remote code on GoCD Server

    HighCVSS 8.8No exploitEPSS 2%

    thoughtworks · gocdOct 14, 2022

  • CVE-2021-25924
    35Monitor

    In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup

    HighCVSS 8.8No exploitEPSS 1%

    thoughtworks · gocdApr 1, 2021

  • CVE-2021-43289
    31Monitor

    An issue was discovered in ThoughtWorks GoCD before 21.3.0.

    HighCVSS 7.5No exploitEPSS 2%

    thoughtworks · gocdApr 14, 2022

  • CVE-2022-24832
    28Monitor

    Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames

    MediumCVSS 6.8No exploitEPSS 2%

    thoughtworks · gocdApr 11, 2022

  • CVE-2022-39309
    26Monitor

    GoCD server secret encryption/decryption key leaked to agents during material serialization

    MediumCVSS 6.5No exploitEPSS 1%

    thoughtworks · gocdOct 14, 2022

  • CVE-2022-39310
    26Monitor

    Malicious agent may be able to impersonate another agent in GoCD

    MediumCVSS 6.5No exploitEPSS 1%

    thoughtworks · gocdOct 14, 2022

  • CVE-2021-29057
    26Monitor

    An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service.

    MediumCVSS 6.5No exploitEPSS 1%

    thoughtworks · node-worker-threads-poolAug 11, 2023

  • CVE-2022-29183
    24Monitor

    Reflected XSS in GoCD

    MediumCVSS 6.1No exploitEPSS 1%

    thoughtworks · gocdMay 20, 2022

  • CVE-2024-28866
    24Monitor

    GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-up

    MediumCVSS 6.1No exploitEPSS 0%

    thoughtworks · gocdMay 14, 2024

  • CVE-2022-39308
    23Monitor

    GoCD API authentication of user access tokens subject to timing attack during comparison

    MediumCVSS 5.9No exploitEPSS 1%

    thoughtworks · gocdOct 14, 2022

  • CVE-2022-36088
    22Monitor

    GoCD Windows installations outside default location inadequately restrict installation file permissions

    MediumCVSS 5.5No exploitEPSS 0%

    thoughtworks · gocdSep 7, 2022

  • CVE-2021-43288
    21Monitor

    An issue was discovered in ThoughtWorks GoCD before 21.3.0.

    MediumCVSS 5.4No exploitEPSS 1%

    thoughtworks · gocdApr 14, 2022

  • CVE-2022-29182
    21Monitor

    DOM-based XSS in GoCD

    MediumCVSS 5.4No exploitEPSS 1%

    thoughtworks · gocdMay 20, 2022

  • CVE-2023-28629
    21Monitor

    Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd

    MediumCVSS 5.4No exploitEPSS 0%

    thoughtworks · gocdMar 27, 2023

  • CVE-2023-28630
    17Monitor

    Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd

    MediumCVSS 4.4No exploitEPSS 0%

    thoughtworks · gocdMar 27, 2023

  • CVE-2024-56321
    15Monitor

    GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access

    LowCVSS 3.8No exploitEPSS 1%

    thoughtworks · gocdJan 3, 2025

  • CVE-2024-56324
    8Monitor

    GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins

    LowCVSS 2.1No exploitEPSS 1%

    thoughtworks · gocdJan 3, 2025

  • CVE-2024-56322
    8Monitor

    GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality

    LowCVSS 2.1No exploitEPSS 1%

    thoughtworks · gocdJan 3, 2025