netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-7f6w-fhmr-j8hq
GHSA-g7cf-wg27-qw87
GHSA-gw8g-hh47-q4gw
GHSA-c3v2-5388-v8pw
This commit is contained in:
advisory-database[bot]
2024-01-30 23:17:58 +00:00
parent 655cfc1528
commit 0e58e4e36c
4 changed files with 98 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-7f6w-fhmr-j8hq/GHSA-7f6w-fhmr-j8hq.json → advisories/github-reviewed/2022/05/GHSA-7f6w-fhmr-j8hq/GHSA-7f6w-fhmr-j8hq.json
+23 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7f6w-fhmr-j8hq",
"modified": "2022-05-17T00:50:19Z",
"modified": "2024-01-30T23:16:51Z",
"published": "2022-05-17T00:50:19Z",
"aliases": [
"CVE-2014-9635"
],
"summary": "Jenkins HttpOnly flag not Set for session cookies",
"details": "Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.586"
}
]
}
]
}
],
"references": [
{
@@ -55,8 +74,8 @@
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T23:16:51Z",
"nvd_published_at": "2017-09-12T14:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-g7cf-wg27-qw87/GHSA-g7cf-wg27-qw87.json → advisories/github-reviewed/2022/05/GHSA-g7cf-wg27-qw87/GHSA-g7cf-wg27-qw87.json
+23 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g7cf-wg27-qw87",
"modified": "2022-05-17T00:50:18Z",
"modified": "2024-01-30T23:17:03Z",
"published": "2022-05-17T00:50:18Z",
"aliases": [
"CVE-2014-9634"
],
"summary": "Jenkins secure flag not set on session cookies",
"details": "Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.586"
}
]
}
]
}
],
"references": [
{
@@ -55,8 +74,8 @@
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T23:17:03Z",
"nvd_published_at": "2017-09-12T14:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-gw8g-hh47-q4gw/GHSA-gw8g-hh47-q4gw.json → advisories/github-reviewed/2022/05/GHSA-gw8g-hh47-q4gw/GHSA-gw8g-hh47-q4gw.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gw8g-hh47-q4gw",
"modified": "2022-05-14T03:45:23Z",
"modified": "2024-01-30T23:17:25Z",
"published": "2022-05-14T03:45:23Z",
"aliases": [
"CVE-2017-1000389"
],
"summary": "Cross-Site Request Forgery (CSRF) vulnerability in Jenkins global-build-stats plugin",
"details": "Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had the Content Type: text/html, so could have been interpreted as HTML by clients, resulting in a potential reflected cross-site scripting vulnerability. Additionally, some URLs provided by global-build-stats plugin that modify data did not require POST requests to be sent, resulting in a potential cross-site request forgery vulnerability.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:global-build-stats"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 1.4"
}
}
],
"references": [
{
@@ -31,8 +53,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T23:17:25Z",
"nvd_published_at": "2018-01-26T02:29:00Z"
}
}
advisories/unreviewed/2023/02/GHSA-c3v2-5388-v8pw/GHSA-c3v2-5388-v8pw.json → advisories/github-reviewed/2023/02/GHSA-c3v2-5388-v8pw/GHSA-c3v2-5388-v8pw.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c3v2-5388-v8pw",
"modified": "2023-02-23T06:30:19Z",
"modified": "2024-01-30T23:16:38Z",
"published": "2023-02-15T21:30:30Z",
"aliases": [
"CVE-2023-23848"
],
"summary": "CSRF vulnerability in Jenkins Coverity Plugin allow capturing credentials",
"details": "Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:synopsys-coverity"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.3"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 3.0.2"
}
}
],
"references": [
{
@@ -35,8 +57,8 @@
"CWE-276"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T23:16:38Z",
"nvd_published_at": "2023-02-15T19:15:00Z"
}
}