diff --git a/advisories/unreviewed/2022/05/GHSA-492x-gfqx-wpf3/GHSA-492x-gfqx-wpf3.json b/advisories/github-reviewed/2022/05/GHSA-492x-gfqx-wpf3/GHSA-492x-gfqx-wpf3.json similarity index 67% rename from advisories/unreviewed/2022/05/GHSA-492x-gfqx-wpf3/GHSA-492x-gfqx-wpf3.json rename to advisories/github-reviewed/2022/05/GHSA-492x-gfqx-wpf3/GHSA-492x-gfqx-wpf3.json index 9070443a021..c91476e6c8c 100644 --- a/advisories/unreviewed/2022/05/GHSA-492x-gfqx-wpf3/GHSA-492x-gfqx-wpf3.json +++ b/advisories/github-reviewed/2022/05/GHSA-492x-gfqx-wpf3/GHSA-492x-gfqx-wpf3.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-492x-gfqx-wpf3", - "modified": "2022-05-13T01:17:42Z", + "modified": "2024-01-30T22:03:31Z", "published": "2022-05-13T01:17:42Z", "aliases": [ "CVE-2019-1003077" ], + "summary": "Missing permission check in Jenkins Audit to Database Plugin", "details": "A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:audit2db" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.5" + } + ] + } + ] + } ], "references": [ { @@ -39,8 +58,8 @@ "CWE-862" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:03:31Z", "nvd_published_at": "2019-04-04T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-56ff-m6pv-8594/GHSA-56ff-m6pv-8594.json b/advisories/github-reviewed/2022/05/GHSA-56ff-m6pv-8594/GHSA-56ff-m6pv-8594.json similarity index 66% rename from advisories/unreviewed/2022/05/GHSA-56ff-m6pv-8594/GHSA-56ff-m6pv-8594.json rename to advisories/github-reviewed/2022/05/GHSA-56ff-m6pv-8594/GHSA-56ff-m6pv-8594.json index c1929eb70d2..97a0227f1a8 100644 --- a/advisories/unreviewed/2022/05/GHSA-56ff-m6pv-8594/GHSA-56ff-m6pv-8594.json +++ b/advisories/github-reviewed/2022/05/GHSA-56ff-m6pv-8594/GHSA-56ff-m6pv-8594.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-56ff-m6pv-8594", - "modified": "2022-05-13T01:25:16Z", + "modified": "2024-01-30T22:03:52Z", "published": "2022-05-13T01:25:16Z", "aliases": [ "CVE-2019-1003079" ], + "summary": "Missing permission check in Jenkins VMware Lab Manager Slaves Plugin", "details": "A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:labmanager" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.2.8" + } + ] + } + ] + } ], "references": [ { @@ -39,8 +58,8 @@ "CWE-862" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:03:52Z", "nvd_published_at": "2019-04-04T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-cvh8-9j4x-5v4j/GHSA-cvh8-9j4x-5v4j.json b/advisories/github-reviewed/2022/05/GHSA-cvh8-9j4x-5v4j/GHSA-cvh8-9j4x-5v4j.json similarity index 65% rename from advisories/unreviewed/2022/05/GHSA-cvh8-9j4x-5v4j/GHSA-cvh8-9j4x-5v4j.json rename to advisories/github-reviewed/2022/05/GHSA-cvh8-9j4x-5v4j/GHSA-cvh8-9j4x-5v4j.json index f078c7cd8c2..0ef01cd509a 100644 --- a/advisories/unreviewed/2022/05/GHSA-cvh8-9j4x-5v4j/GHSA-cvh8-9j4x-5v4j.json +++ b/advisories/github-reviewed/2022/05/GHSA-cvh8-9j4x-5v4j/GHSA-cvh8-9j4x-5v4j.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-cvh8-9j4x-5v4j", - "modified": "2022-05-13T01:18:46Z", + "modified": "2024-01-30T22:04:02Z", "published": "2022-05-13T01:18:46Z", "aliases": [ "CVE-2018-1000424" ], + "summary": "Jenkins Artifactory Plugin stored old directly entered credentials unencrypted on disk ", "details": "An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:artifactory" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.16.2" + } + ] + } + ] + } ], "references": [ { @@ -35,8 +54,8 @@ "CWE-522" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:04:02Z", "nvd_published_at": "2019-01-09T23:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-vhh3-mvc4-hhq6/GHSA-vhh3-mvc4-hhq6.json b/advisories/github-reviewed/2022/05/GHSA-vhh3-mvc4-hhq6/GHSA-vhh3-mvc4-hhq6.json similarity index 57% rename from advisories/unreviewed/2022/05/GHSA-vhh3-mvc4-hhq6/GHSA-vhh3-mvc4-hhq6.json rename to advisories/github-reviewed/2022/05/GHSA-vhh3-mvc4-hhq6/GHSA-vhh3-mvc4-hhq6.json index 5346d799e86..60a47ba037c 100644 --- a/advisories/unreviewed/2022/05/GHSA-vhh3-mvc4-hhq6/GHSA-vhh3-mvc4-hhq6.json +++ b/advisories/github-reviewed/2022/05/GHSA-vhh3-mvc4-hhq6/GHSA-vhh3-mvc4-hhq6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vhh3-mvc4-hhq6", - "modified": "2022-05-13T01:18:20Z", + "modified": "2024-01-30T22:03:41Z", "published": "2022-05-13T01:18:20Z", "aliases": [ "CVE-2017-1000388" ], + "summary": "Jenkins Dependency Graph Viewer plugin vulnerable to missing permission checks", "details": "Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing anyone with Overall/Read permission to modify this data.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:depgraph-view" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.13" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.12" + } + } ], "references": [ { @@ -31,8 +53,8 @@ "CWE-862" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:03:41Z", "nvd_published_at": "2018-01-26T02:29:00Z" } } \ No newline at end of file