netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-5xm3-48v5-6h7v
GHSA-fvfh-8mj3-23xj
GHSA-mm9c-4cv4-7rfv
GHSA-w3f5-gq7j-m797
GHSA-5xm3-48v5-6h7v
GHSA-fvfh-8mj3-23xj
GHSA-mm9c-4cv4-7rfv
GHSA-w3f5-gq7j-m797
This commit is contained in:
advisory-database[bot]
2025-03-13 19:17:50 +00:00
parent 89327b709f
commit 36335b3a60
8 changed files with 366 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json
+100
View File
@@ -0,0 +1,100 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5xm3-48v5-6h7v",
"modified": "2025-03-13T19:15:21Z",
"published": "2022-05-17T03:53:32Z",
"aliases": [
"CVE-2014-3667"
],
"summary": "Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code",
"details": "Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.566"
},
{
"fixed": "1.583"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.565.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3667"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/f0a29b562e14d837912c6b35fa4e81478563813a"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2014:1630"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2014-3667"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1147770"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T19:15:21Z",
"nvd_published_at": "2014-10-16T19:55:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json
+88
View File
@@ -0,0 +1,88 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fvfh-8mj3-23xj",
"modified": "2025-03-13T19:15:37Z",
"published": "2022-05-17T03:53:34Z",
"aliases": [
"CVE-2014-3666"
],
"summary": "Jenkins allows for Code Execution via Crafted Packet to the CLI",
"details": "Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.566"
},
{
"fixed": "1.583"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.565.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3666"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/be195b0e19343bff6d966029d8eea99b2c039c32"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T19:15:37Z",
"nvd_published_at": "2014-10-16T19:55:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json
+92
View File
@@ -0,0 +1,92 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mm9c-4cv4-7rfv",
"modified": "2025-03-13T19:15:04Z",
"published": "2022-05-17T03:53:32Z",
"aliases": [
"CVE-2015-1806"
],
"summary": "Jenkins allows for Privilege Escalation by Remote Authenticated Users",
"details": "The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.597"
},
{
"fixed": "1.600"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.596.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1806"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205620"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T19:15:04Z",
"nvd_published_at": "2015-10-16T20:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json
+86
View File
@@ -0,0 +1,86 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w3f5-gq7j-m797",
"modified": "2025-03-13T19:17:22Z",
"published": "2022-05-17T03:53:54Z",
"aliases": [
"CVE-2014-2063"
],
"summary": "Jenkins Vulnerable to Clickjacking",
"details": "Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.533"
},
{
"fixed": "1.551"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.532.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2063"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/16931bd7bf7560e26ef98328b8e95e803d0e90f6"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/02/21/2"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T19:17:22Z",
"nvd_published_at": "2014-10-17T15:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json
-47
View File
@@ -1,47 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5xm3-48v5-6h7v",
"modified": "2022-05-17T03:53:32Z",
"published": "2022-05-17T03:53:32Z",
"aliases": [
"CVE-2014-3667"
],
"details": "Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3667"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2014:1630"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2014-3667"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1147770"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-10-16T19:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fvfh-8mj3-23xj",
"modified": "2022-05-17T03:53:34Z",
"published": "2022-05-17T03:53:34Z",
"aliases": [
"CVE-2014-3666"
],
"details": "Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3666"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-10-16T19:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json
-41
View File
@@ -1,41 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mm9c-4cv4-7rfv",
"modified": "2022-05-17T03:53:32Z",
"published": "2022-05-17T03:53:32Z",
"aliases": [
"CVE-2015-1806"
],
"details": "The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1806"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205620"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-10-16T20:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json
-37
View File
@@ -1,37 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w3f5-gq7j-m797",
"modified": "2022-05-17T03:53:54Z",
"published": "2022-05-17T03:53:54Z",
"aliases": [
"CVE-2014-2063"
],
"details": "Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2063"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/16931bd7bf7560e26ef98328b8e95e803d0e90f6"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/02/21/2"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-10-17T15:55:00Z"
}
}