diff --git a/advisories/unreviewed/2022/05/GHSA-7f6w-fhmr-j8hq/GHSA-7f6w-fhmr-j8hq.json b/advisories/github-reviewed/2022/05/GHSA-7f6w-fhmr-j8hq/GHSA-7f6w-fhmr-j8hq.json similarity index 73% rename from advisories/unreviewed/2022/05/GHSA-7f6w-fhmr-j8hq/GHSA-7f6w-fhmr-j8hq.json rename to advisories/github-reviewed/2022/05/GHSA-7f6w-fhmr-j8hq/GHSA-7f6w-fhmr-j8hq.json index a03a3c6c2ae..0d6360e12d4 100644 --- a/advisories/unreviewed/2022/05/GHSA-7f6w-fhmr-j8hq/GHSA-7f6w-fhmr-j8hq.json +++ b/advisories/github-reviewed/2022/05/GHSA-7f6w-fhmr-j8hq/GHSA-7f6w-fhmr-j8hq.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-7f6w-fhmr-j8hq", - "modified": "2022-05-17T00:50:19Z", + "modified": "2024-01-30T23:16:51Z", "published": "2022-05-17T00:50:19Z", "aliases": [ "CVE-2014-9635" ], + "summary": "Jenkins HttpOnly flag not Set for session cookies", "details": "Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.586" + } + ] + } + ] + } ], "references": [ { @@ -55,8 +74,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:16:51Z", "nvd_published_at": "2017-09-12T14:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-g7cf-wg27-qw87/GHSA-g7cf-wg27-qw87.json b/advisories/github-reviewed/2022/05/GHSA-g7cf-wg27-qw87/GHSA-g7cf-wg27-qw87.json similarity index 73% rename from advisories/unreviewed/2022/05/GHSA-g7cf-wg27-qw87/GHSA-g7cf-wg27-qw87.json rename to advisories/github-reviewed/2022/05/GHSA-g7cf-wg27-qw87/GHSA-g7cf-wg27-qw87.json index dde84db5f18..8bbfc15e19a 100644 --- a/advisories/unreviewed/2022/05/GHSA-g7cf-wg27-qw87/GHSA-g7cf-wg27-qw87.json +++ b/advisories/github-reviewed/2022/05/GHSA-g7cf-wg27-qw87/GHSA-g7cf-wg27-qw87.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-g7cf-wg27-qw87", - "modified": "2022-05-17T00:50:18Z", + "modified": "2024-01-30T23:17:03Z", "published": "2022-05-17T00:50:18Z", "aliases": [ "CVE-2014-9634" ], + "summary": "Jenkins secure flag not set on session cookies", "details": "Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.586" + } + ] + } + ] + } ], "references": [ { @@ -55,8 +74,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:17:03Z", "nvd_published_at": "2017-09-12T14:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-gw8g-hh47-q4gw/GHSA-gw8g-hh47-q4gw.json b/advisories/github-reviewed/2022/05/GHSA-gw8g-hh47-q4gw/GHSA-gw8g-hh47-q4gw.json similarity index 63% rename from advisories/unreviewed/2022/05/GHSA-gw8g-hh47-q4gw/GHSA-gw8g-hh47-q4gw.json rename to advisories/github-reviewed/2022/05/GHSA-gw8g-hh47-q4gw/GHSA-gw8g-hh47-q4gw.json index b7799c719ad..d31fd69c5bc 100644 --- a/advisories/unreviewed/2022/05/GHSA-gw8g-hh47-q4gw/GHSA-gw8g-hh47-q4gw.json +++ b/advisories/github-reviewed/2022/05/GHSA-gw8g-hh47-q4gw/GHSA-gw8g-hh47-q4gw.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-gw8g-hh47-q4gw", - "modified": "2022-05-14T03:45:23Z", + "modified": "2024-01-30T23:17:25Z", "published": "2022-05-14T03:45:23Z", "aliases": [ "CVE-2017-1000389" ], + "summary": "Cross-Site Request Forgery (CSRF) vulnerability in Jenkins global-build-stats plugin", "details": "Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had the Content Type: text/html, so could have been interpreted as HTML by clients, resulting in a potential reflected cross-site scripting vulnerability. Additionally, some URLs provided by global-build-stats plugin that modify data did not require POST requests to be sent, resulting in a potential cross-site request forgery vulnerability.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:global-build-stats" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.4" + } + } ], "references": [ { @@ -31,8 +53,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:17:25Z", "nvd_published_at": "2018-01-26T02:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/02/GHSA-c3v2-5388-v8pw/GHSA-c3v2-5388-v8pw.json b/advisories/github-reviewed/2023/02/GHSA-c3v2-5388-v8pw/GHSA-c3v2-5388-v8pw.json similarity index 63% rename from advisories/unreviewed/2023/02/GHSA-c3v2-5388-v8pw/GHSA-c3v2-5388-v8pw.json rename to advisories/github-reviewed/2023/02/GHSA-c3v2-5388-v8pw/GHSA-c3v2-5388-v8pw.json index 2c145d5c7fc..9aab2990246 100644 --- a/advisories/unreviewed/2023/02/GHSA-c3v2-5388-v8pw/GHSA-c3v2-5388-v8pw.json +++ b/advisories/github-reviewed/2023/02/GHSA-c3v2-5388-v8pw/GHSA-c3v2-5388-v8pw.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-c3v2-5388-v8pw", - "modified": "2023-02-23T06:30:19Z", + "modified": "2024-01-30T23:16:38Z", "published": "2023-02-15T21:30:30Z", "aliases": [ "CVE-2023-23848" ], + "summary": "CSRF vulnerability in Jenkins Coverity Plugin allow capturing credentials", "details": "Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:synopsys-coverity" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.0.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.0.2" + } + } ], "references": [ { @@ -35,8 +57,8 @@ "CWE-276" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:16:38Z", "nvd_published_at": "2023-02-15T19:15:00Z" } } \ No newline at end of file