netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3ccq-gccx-pm7j
GHSA-cq9m-rpm5-27m9
GHSA-r5jr-82x4-r6j7
GHSA-whcg-2364-672f
This commit is contained in:
advisory-database[bot]
2024-01-30 21:55:22 +00:00
parent b4c670913a
commit 3733757b84
4 changed files with 102 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-3ccq-gccx-pm7j/GHSA-3ccq-gccx-pm7j.json → advisories/github-reviewed/2022/05/GHSA-3ccq-gccx-pm7j/GHSA-3ccq-gccx-pm7j.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3ccq-gccx-pm7j",
"modified": "2022-05-13T01:18:46Z",
"modified": "2024-01-30T21:54:16Z",
"published": "2022-05-13T01:18:46Z",
"aliases": [
"CVE-2018-1000425"
],
"summary": "Jenkins SonarQube Scanner Plugin stored server authentication token in plain text",
"details": "An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:sonar"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.1"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.8"
}
}
],
"references": [
{
@@ -35,8 +57,8 @@
"CWE-522"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:54:16Z",
"nvd_published_at": "2019-01-09T23:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-cq9m-rpm5-27m9/GHSA-cq9m-rpm5-27m9.json → advisories/github-reviewed/2022/05/GHSA-cq9m-rpm5-27m9/GHSA-cq9m-rpm5-27m9.json
+23 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cq9m-rpm5-27m9",
"modified": "2022-05-13T01:17:42Z",
"modified": "2024-01-30T21:53:52Z",
"published": "2022-05-13T01:17:42Z",
"aliases": [
"CVE-2019-1003095"
],
"summary": "Jenkins Perfecto Mobile Plugin stores credentials in plain text",
"details": "Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:perfectomobile"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.62.0.3"
}
]
}
]
}
],
"references": [
{
@@ -39,8 +58,8 @@
"CWE-311"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:53:52Z",
"nvd_published_at": "2019-04-04T16:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-r5jr-82x4-r6j7/GHSA-r5jr-82x4-r6j7.json → advisories/github-reviewed/2022/05/GHSA-r5jr-82x4-r6j7/GHSA-r5jr-82x4-r6j7.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r5jr-82x4-r6j7",
"modified": "2022-05-13T01:25:16Z",
"modified": "2024-01-30T21:53:09Z",
"published": "2022-05-13T01:25:16Z",
"aliases": [
"CVE-2019-1003097"
],
"summary": "Jenkins Crowd Integration Plugin stores credentials in plain text",
"details": "Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.ds.tools.hudson:crowd"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003097"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/crowd-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1069"
@@ -39,8 +62,8 @@
"CWE-522"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:53:09Z",
"nvd_published_at": "2019-04-04T16:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-whcg-2364-672f/GHSA-whcg-2364-672f.json → advisories/github-reviewed/2022/05/GHSA-whcg-2364-672f/GHSA-whcg-2364-672f.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-whcg-2364-672f",
"modified": "2022-05-13T01:15:02Z",
"modified": "2024-01-30T21:54:25Z",
"published": "2022-05-13T01:15:02Z",
"aliases": [
"CVE-2019-10290"
],
"summary": "Missing permission check in Jenkins Netsparker Cloud Scan Plugin",
"details": "A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method allowed attackers with Overall/Read permission to initiate a connection to an attacker-specified server.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:netsparker-cloud-scan"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.6"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 1.1.5"
}
}
],
"references": [
{
@@ -39,8 +61,8 @@
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:54:25Z",
"nvd_published_at": "2019-04-04T16:29:00Z"
}
}