diff --git a/advisories/github-reviewed/2022/05/GHSA-qg7x-4h4q-3m49/GHSA-qg7x-4h4q-3m49.json b/advisories/github-reviewed/2022/05/GHSA-qg7x-4h4q-3m49/GHSA-qg7x-4h4q-3m49.json new file mode 100644 index 00000000000..a5a44f71d13 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-qg7x-4h4q-3m49/GHSA-qg7x-4h4q-3m49.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qg7x-4h4q-3m49", + "modified": "2024-01-30T21:10:30Z", + "published": "2022-05-24T17:06:12Z", + "aliases": [ + "CVE-2015-1811" + ], + "summary": "XML external entity (XXE) vulnerability in Jenkins", + "details": "XML external entity (XXE) vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.597" + }, + { + "fixed": "1.600" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.596.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1811" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205632" + }, + { + "type": "WEB", + "url": "https://jenkins.io/security/advisory/2015-02-27/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:10:30Z", + "nvd_published_at": "2020-01-15T19:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-qj27-w92h-fc9r/GHSA-qj27-w92h-fc9r.json b/advisories/github-reviewed/2022/05/GHSA-qj27-w92h-fc9r/GHSA-qj27-w92h-fc9r.json new file mode 100644 index 00000000000..815abec0c21 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-qj27-w92h-fc9r/GHSA-qj27-w92h-fc9r.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qj27-w92h-fc9r", + "modified": "2024-01-30T21:10:14Z", + "published": "2022-05-24T17:06:12Z", + "aliases": [ + "CVE-2015-1809" + ], + "summary": "XML external entity (XXE) vulnerability in Jenkins", + "details": "XML external entity (XXE) vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.597" + }, + { + "fixed": "1.600" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.596.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1809" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205625" + }, + { + "type": "WEB", + "url": "https://jenkins.io/security/advisory/2015-02-27/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-611" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:10:14Z", + "nvd_published_at": "2020-01-15T19:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-wwrr-4jp4-58wg/GHSA-wwrr-4jp4-58wg.json b/advisories/github-reviewed/2022/05/GHSA-wwrr-4jp4-58wg/GHSA-wwrr-4jp4-58wg.json similarity index 64% rename from advisories/unreviewed/2022/05/GHSA-wwrr-4jp4-58wg/GHSA-wwrr-4jp4-58wg.json rename to advisories/github-reviewed/2022/05/GHSA-wwrr-4jp4-58wg/GHSA-wwrr-4jp4-58wg.json index 406a1737e25..50330a4d214 100644 --- a/advisories/unreviewed/2022/05/GHSA-wwrr-4jp4-58wg/GHSA-wwrr-4jp4-58wg.json +++ b/advisories/github-reviewed/2022/05/GHSA-wwrr-4jp4-58wg/GHSA-wwrr-4jp4-58wg.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-wwrr-4jp4-58wg", - "modified": "2023-10-25T18:31:32Z", + "modified": "2024-01-30T21:11:17Z", "published": "2022-05-24T17:03:48Z", "aliases": [ "CVE-2019-16569" ], + "summary": "CSRF vulnerability in Jenkins Mantis Plugin ", "details": "A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified web server using attacker-specified credentials.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:mantis" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.26" + } + ] + } + ] + } ], "references": [ { @@ -35,8 +54,8 @@ "CWE-352" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:11:06Z", "nvd_published_at": "2019-12-17T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-qg7x-4h4q-3m49/GHSA-qg7x-4h4q-3m49.json b/advisories/unreviewed/2022/05/GHSA-qg7x-4h4q-3m49/GHSA-qg7x-4h4q-3m49.json deleted file mode 100644 index 293d35b7159..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-qg7x-4h4q-3m49/GHSA-qg7x-4h4q-3m49.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-qg7x-4h4q-3m49", - "modified": "2022-05-24T17:06:12Z", - "published": "2022-05-24T17:06:12Z", - "aliases": [ - "CVE-2015-1811" - ], - "details": "XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1811" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205632" - }, - { - "type": "WEB", - "url": "https://jenkins.io/security/advisory/2015-02-27/" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-01-15T19:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-qj27-w92h-fc9r/GHSA-qj27-w92h-fc9r.json b/advisories/unreviewed/2022/05/GHSA-qj27-w92h-fc9r/GHSA-qj27-w92h-fc9r.json deleted file mode 100644 index 51080041677..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-qj27-w92h-fc9r/GHSA-qj27-w92h-fc9r.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-qj27-w92h-fc9r", - "modified": "2022-05-24T17:06:12Z", - "published": "2022-05-24T17:06:12Z", - "aliases": [ - "CVE-2015-1809" - ], - "details": "XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1809" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205625" - }, - { - "type": "WEB", - "url": "https://jenkins.io/security/advisory/2015-02-27/" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-01-15T19:15:00Z" - } -} \ No newline at end of file