netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-46rr-87h4-f5q6
GHSA-c3wf-rrhq-rfp2
GHSA-qh3m-c6hw-5hmv
GHSA-rxph-cq38-gm3g
This commit is contained in:
advisory-database[bot]
2024-01-30 21:14:26 +00:00
parent 0377ee5b1a
commit 21498ff447
4 changed files with 101 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-46rr-87h4-f5q6/GHSA-46rr-87h4-f5q6.json → advisories/github-reviewed/2022/05/GHSA-46rr-87h4-f5q6/GHSA-46rr-87h4-f5q6.json
+24 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-46rr-87h4-f5q6",
"modified": "2023-10-25T18:31:31Z",
"modified": "2024-01-30T21:13:29Z",
"published": "2022-05-24T17:03:47Z",
"aliases": [
"CVE-2019-16561"
],
"summary": "SSL/TLS certificate validation globally and unconditionally disabled by Jenkins WebSphere Deployer Plugin ",
"details": "Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:websphere-deployer"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.6.1"
}
]
}
]
}
],
"references": [
{
@@ -34,9 +53,9 @@
"cwe_ids": [
"CWE-295"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:13:29Z",
"nvd_published_at": "2019-12-17T15:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-c3wf-rrhq-rfp2/GHSA-c3wf-rrhq-rfp2.json → advisories/github-reviewed/2022/05/GHSA-c3wf-rrhq-rfp2/GHSA-c3wf-rrhq-rfp2.json
+24 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c3wf-rrhq-rfp2",
"modified": "2023-10-25T18:31:31Z",
"modified": "2024-01-30T21:13:36Z",
"published": "2022-05-24T17:03:47Z",
"aliases": [
"CVE-2019-16560"
],
"summary": "Cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin",
"details": "A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:websphere-deployer"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.6.1"
}
]
}
]
}
],
"references": [
{
@@ -34,9 +53,9 @@
"cwe_ids": [
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:13:36Z",
"nvd_published_at": "2019-12-17T15:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-qh3m-c6hw-5hmv/GHSA-qh3m-c6hw-5hmv.json → advisories/github-reviewed/2022/05/GHSA-qh3m-c6hw-5hmv/GHSA-qh3m-c6hw-5hmv.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qh3m-c6hw-5hmv",
"modified": "2023-10-25T18:31:31Z",
"modified": "2024-01-30T21:14:01Z",
"published": "2022-05-24T17:03:47Z",
"aliases": [
"CVE-2019-16556"
],
"summary": "Jenkins Rundeck Plugin stored credentials in plain text ",
"details": "Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:rundeck"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.6"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 3.6.5"
}
}
],
"references": [
{
@@ -35,8 +57,8 @@
"CWE-522"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:14:01Z",
"nvd_published_at": "2019-12-17T15:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-rxph-cq38-gm3g/GHSA-rxph-cq38-gm3g.json → advisories/github-reviewed/2022/05/GHSA-rxph-cq38-gm3g/GHSA-rxph-cq38-gm3g.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rxph-cq38-gm3g",
"modified": "2023-10-25T18:31:32Z",
"modified": "2024-01-30T21:13:03Z",
"published": "2022-05-24T17:03:48Z",
"aliases": [
"CVE-2019-16568"
],
"summary": "Jenkins SCTMExecutor Plugin stores credentials in plain text ",
"details": "Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as individual jobs' configurations.",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "hudson.plugins.sctmexecutor:SCTMExecutor"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16568"
},
{
"type": "WEB",
"url": "https://github.com/jenkins-infra/update-center2/pull/324"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1521"
@@ -35,8 +58,8 @@
"CWE-319"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:13:03Z",
"nvd_published_at": "2019-12-17T15:15:00Z"
}
}