From 3733757b848927af82529fce83ea902094060225 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 30 Jan 2024 21:55:22 +0000 Subject: [PATCH] Publish Advisories GHSA-3ccq-gccx-pm7j GHSA-cq9m-rpm5-27m9 GHSA-r5jr-82x4-r6j7 GHSA-whcg-2364-672f --- .../GHSA-3ccq-gccx-pm7j.json | 30 +++++++++++++++--- .../GHSA-cq9m-rpm5-27m9.json | 27 +++++++++++++--- .../GHSA-r5jr-82x4-r6j7.json | 31 ++++++++++++++++--- .../GHSA-whcg-2364-672f.json | 30 +++++++++++++++--- 4 files changed, 102 insertions(+), 16 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-3ccq-gccx-pm7j/GHSA-3ccq-gccx-pm7j.json (60%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-cq9m-rpm5-27m9/GHSA-cq9m-rpm5-27m9.json (65%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-r5jr-82x4-r6j7/GHSA-r5jr-82x4-r6j7.json (62%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-whcg-2364-672f/GHSA-whcg-2364-672f.json (63%) diff --git a/advisories/unreviewed/2022/05/GHSA-3ccq-gccx-pm7j/GHSA-3ccq-gccx-pm7j.json b/advisories/github-reviewed/2022/05/GHSA-3ccq-gccx-pm7j/GHSA-3ccq-gccx-pm7j.json similarity index 60% rename from advisories/unreviewed/2022/05/GHSA-3ccq-gccx-pm7j/GHSA-3ccq-gccx-pm7j.json rename to advisories/github-reviewed/2022/05/GHSA-3ccq-gccx-pm7j/GHSA-3ccq-gccx-pm7j.json index 7a3e4b2e2d5..2bbebf827fe 100644 --- a/advisories/unreviewed/2022/05/GHSA-3ccq-gccx-pm7j/GHSA-3ccq-gccx-pm7j.json +++ b/advisories/github-reviewed/2022/05/GHSA-3ccq-gccx-pm7j/GHSA-3ccq-gccx-pm7j.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-3ccq-gccx-pm7j", - "modified": "2022-05-13T01:18:46Z", + "modified": "2024-01-30T21:54:16Z", "published": "2022-05-13T01:18:46Z", "aliases": [ "CVE-2018-1000425" ], + "summary": "Jenkins SonarQube Scanner Plugin stored server authentication token in plain text", "details": "An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:sonar" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.8" + } + } ], "references": [ { @@ -35,8 +57,8 @@ "CWE-522" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:54:16Z", "nvd_published_at": "2019-01-09T23:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-cq9m-rpm5-27m9/GHSA-cq9m-rpm5-27m9.json b/advisories/github-reviewed/2022/05/GHSA-cq9m-rpm5-27m9/GHSA-cq9m-rpm5-27m9.json similarity index 65% rename from advisories/unreviewed/2022/05/GHSA-cq9m-rpm5-27m9/GHSA-cq9m-rpm5-27m9.json rename to advisories/github-reviewed/2022/05/GHSA-cq9m-rpm5-27m9/GHSA-cq9m-rpm5-27m9.json index 2c6618307ae..2991ab71eaf 100644 --- a/advisories/unreviewed/2022/05/GHSA-cq9m-rpm5-27m9/GHSA-cq9m-rpm5-27m9.json +++ b/advisories/github-reviewed/2022/05/GHSA-cq9m-rpm5-27m9/GHSA-cq9m-rpm5-27m9.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-cq9m-rpm5-27m9", - "modified": "2022-05-13T01:17:42Z", + "modified": "2024-01-30T21:53:52Z", "published": "2022-05-13T01:17:42Z", "aliases": [ "CVE-2019-1003095" ], + "summary": "Jenkins Perfecto Mobile Plugin stores credentials in plain text", "details": "Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:perfectomobile" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.62.0.3" + } + ] + } + ] + } ], "references": [ { @@ -39,8 +58,8 @@ "CWE-311" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:53:52Z", "nvd_published_at": "2019-04-04T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-r5jr-82x4-r6j7/GHSA-r5jr-82x4-r6j7.json b/advisories/github-reviewed/2022/05/GHSA-r5jr-82x4-r6j7/GHSA-r5jr-82x4-r6j7.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-r5jr-82x4-r6j7/GHSA-r5jr-82x4-r6j7.json rename to advisories/github-reviewed/2022/05/GHSA-r5jr-82x4-r6j7/GHSA-r5jr-82x4-r6j7.json index b69266942dd..d56c035b596 100644 --- a/advisories/unreviewed/2022/05/GHSA-r5jr-82x4-r6j7/GHSA-r5jr-82x4-r6j7.json +++ b/advisories/github-reviewed/2022/05/GHSA-r5jr-82x4-r6j7/GHSA-r5jr-82x4-r6j7.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-r5jr-82x4-r6j7", - "modified": "2022-05-13T01:25:16Z", + "modified": "2024-01-30T21:53:09Z", "published": "2022-05-13T01:25:16Z", "aliases": [ "CVE-2019-1003097" ], + "summary": "Jenkins Crowd Integration Plugin stores credentials in plain text", "details": "Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "com.ds.tools.hudson:crowd" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.2" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003097" }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/crowd-plugin" + }, { "type": "WEB", "url": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1069" @@ -39,8 +62,8 @@ "CWE-522" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:53:09Z", "nvd_published_at": "2019-04-04T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-whcg-2364-672f/GHSA-whcg-2364-672f.json b/advisories/github-reviewed/2022/05/GHSA-whcg-2364-672f/GHSA-whcg-2364-672f.json similarity index 63% rename from advisories/unreviewed/2022/05/GHSA-whcg-2364-672f/GHSA-whcg-2364-672f.json rename to advisories/github-reviewed/2022/05/GHSA-whcg-2364-672f/GHSA-whcg-2364-672f.json index f38df909bae..4561cb1303c 100644 --- a/advisories/unreviewed/2022/05/GHSA-whcg-2364-672f/GHSA-whcg-2364-672f.json +++ b/advisories/github-reviewed/2022/05/GHSA-whcg-2364-672f/GHSA-whcg-2364-672f.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-whcg-2364-672f", - "modified": "2022-05-13T01:15:02Z", + "modified": "2024-01-30T21:54:25Z", "published": "2022-05-13T01:15:02Z", "aliases": [ "CVE-2019-10290" ], + "summary": "Missing permission check in Jenkins Netsparker Cloud Scan Plugin", "details": "A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method allowed attackers with Overall/Read permission to initiate a connection to an attacker-specified server.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:netsparker-cloud-scan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.1.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.1.5" + } + } ], "references": [ { @@ -39,8 +61,8 @@ "CWE-862" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:54:25Z", "nvd_published_at": "2019-04-04T16:29:00Z" } } \ No newline at end of file