netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-6954-h5c8-m29f
GHSA-vp68-fm96-7v79
This commit is contained in:
advisory-database[bot]
2024-01-03 13:31:52 +00:00
parent b7afcd65a2
commit 317831623e
2 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/07/GHSA-6954-h5c8-m29f/GHSA-6954-h5c8-m29f.json
+11 -4
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6954-h5c8-m29f",
"modified": "2023-10-27T20:51:25Z",
"modified": "2024-01-03T13:30:13Z",
"published": "2022-07-28T00:00:42Z",
"aliases": [
"CVE-2022-36922"
],
"summary": "Jenkins Lucene-Search Plugin vulnerable to reflected (XSS) cross-site scripting",
"details": "Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the search result page.\n\nThis results in a reflected cross-site scripting (XSS) vulnerability.\n\nAs of publication of this advisory, there is no fix.",
"details": "Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the search result page.\n\nThis results in a reflected cross-site scripting (XSS) vulnerability.\n",
"severity": [
{
"type": "CVSS_V3",
@@ -28,11 +28,14 @@
"introduced": "0"
},
{
"last_affected": "370.v62a5f618cd3a"
"fixed": "387.v938a"
}
]
}
]
],
"database_specific": {
"last_known_affected_version_range": "<= 370.v62a5f618cd3a"
}
}
],
"references": [
@@ -40,6 +43,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36922"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/lucene-search-plugin/commit/5f9fd00d83a5a73a7b9579e8139b3db3a9065ed2"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2812"
advisories/github-reviewed/2022/07/GHSA-vp68-fm96-7v79/GHSA-vp68-fm96-7v79.json
+6 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vp68-fm96-7v79",
"modified": "2023-10-27T20:48:04Z",
"modified": "2024-01-03T13:31:24Z",
"published": "2022-07-28T00:00:42Z",
"aliases": [
"CVE-2022-36915"
],
"summary": "Jenkins Android Signing Plugin allows attackers to check whether attacker-specified file patterns match workspace contents",
"details": "Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation.\n\nThis allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.\n\nAs of publication of this advisory, there is no fix.",
"details": "Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation.\n\nThis allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.",
"severity": [
{
"type": "CVSS_V3",
@@ -40,6 +40,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36915"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/android-signing-plugin/commit/33162c65c9f52ca5fa85609bdb652a5d1feda95b"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2404"