diff --git a/advisories/github-reviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json b/advisories/github-reviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json new file mode 100644 index 00000000000..79a88c0b402 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json @@ -0,0 +1,100 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5xm3-48v5-6h7v", + "modified": "2025-03-13T19:15:21Z", + "published": "2022-05-17T03:53:32Z", + "aliases": [ + "CVE-2014-3667" + ], + "summary": "Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code", + "details": "Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.566" + }, + { + "fixed": "1.583" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.565.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3667" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/f0a29b562e14d837912c6b35fa4e81478563813a" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHBA-2014:1630" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2014-3667" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1147770" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T19:15:21Z", + "nvd_published_at": "2014-10-16T19:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json b/advisories/github-reviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json new file mode 100644 index 00000000000..30ecad2f5e2 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fvfh-8mj3-23xj", + "modified": "2025-03-13T19:15:37Z", + "published": "2022-05-17T03:53:34Z", + "aliases": [ + "CVE-2014-3666" + ], + "summary": "Jenkins allows for Code Execution via Crafted Packet to the CLI", + "details": "Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.566" + }, + { + "fixed": "1.583" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.565.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3666" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/be195b0e19343bff6d966029d8eea99b2c039c32" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T19:15:37Z", + "nvd_published_at": "2014-10-16T19:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json b/advisories/github-reviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json new file mode 100644 index 00000000000..2211e508325 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mm9c-4cv4-7rfv", + "modified": "2025-03-13T19:15:04Z", + "published": "2022-05-17T03:53:32Z", + "aliases": [ + "CVE-2015-1806" + ], + "summary": "Jenkins allows for Privilege Escalation by Remote Authenticated Users", + "details": "The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.597" + }, + { + "fixed": "1.600" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.596.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1806" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205620" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27" + }, + { + "type": "WEB", + "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T19:15:04Z", + "nvd_published_at": "2015-10-16T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json b/advisories/github-reviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json new file mode 100644 index 00000000000..4af6060cd3f --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json @@ -0,0 +1,86 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w3f5-gq7j-m797", + "modified": "2025-03-13T19:17:22Z", + "published": "2022-05-17T03:53:54Z", + "aliases": [ + "CVE-2014-2063" + ], + "summary": "Jenkins Vulnerable to Clickjacking", + "details": "Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.533" + }, + { + "fixed": "1.551" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.532.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2063" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/16931bd7bf7560e26ef98328b8e95e803d0e90f6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2014/02/21/2" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T19:17:22Z", + "nvd_published_at": "2014-10-17T15:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json b/advisories/unreviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json deleted file mode 100644 index f728561d51c..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json +++ /dev/null @@ -1,47 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-5xm3-48v5-6h7v", - "modified": "2022-05-17T03:53:32Z", - "published": "2022-05-17T03:53:32Z", - "aliases": [ - "CVE-2014-3667" - ], - "details": "Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3667" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHBA-2014:1630" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/security/cve/CVE-2014-3667" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1147770" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-10-16T19:55:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json b/advisories/unreviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json deleted file mode 100644 index 1d1ff1b73f2..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fvfh-8mj3-23xj", - "modified": "2022-05-17T03:53:34Z", - "published": "2022-05-17T03:53:34Z", - "aliases": [ - "CVE-2014-3666" - ], - "details": "Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3666" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-10-16T19:55:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json b/advisories/unreviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json deleted file mode 100644 index d703850b54b..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json +++ /dev/null @@ -1,41 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-mm9c-4cv4-7rfv", - "modified": "2022-05-17T03:53:32Z", - "published": "2022-05-17T03:53:32Z", - "aliases": [ - "CVE-2015-1806" - ], - "details": "The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1806" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205620" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27" - }, - { - "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2015-10-16T20:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json b/advisories/unreviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json deleted file mode 100644 index f8921049b54..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-w3f5-gq7j-m797", - "modified": "2022-05-17T03:53:54Z", - "published": "2022-05-17T03:53:54Z", - "aliases": [ - "CVE-2014-2063" - ], - "details": "Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2063" - }, - { - "type": "WEB", - "url": "https://github.com/jenkinsci/jenkins/commit/16931bd7bf7560e26ef98328b8e95e803d0e90f6" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2014/02/21/2" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-10-17T15:55:00Z" - } -} \ No newline at end of file