netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-5v2j-w677-j4mp
GHSA-fvcf-wgxj-h7ch
GHSA-g3rg-cj5x-3vpf
GHSA-mmrv-3cqg-hpf9
GHSA-qrh2-mh97-pw8p
GHSA-wxj2-qc9p-65r3
This commit is contained in:
advisory-database[bot]
2024-01-30 22:27:33 +00:00
parent 7684f687b5
commit 4325f2a214
6 changed files with 141 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-5v2j-w677-j4mp/GHSA-5v2j-w677-j4mp.json → advisories/github-reviewed/2022/05/GHSA-5v2j-w677-j4mp/GHSA-5v2j-w677-j4mp.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5v2j-w677-j4mp",
"modified": "2022-05-13T01:31:34Z",
"modified": "2024-01-30T22:26:51Z",
"published": "2022-05-13T01:31:34Z",
"aliases": [
"CVE-2019-1003027"
],
"summary": "SSRF vulnerability due to missing permission check in Jenkins OctopusDeploy Plugin ",
"details": "A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL and obtain the HTTP response code if successful, and exception error message otherwise.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "hudson.plugins.octopusdeploy:octopusdeploy"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 1.8.1"
}
}
],
"references": [
{
@@ -35,8 +57,8 @@
"CWE-918"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:26:51Z",
"nvd_published_at": "2019-02-20T21:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-fvcf-wgxj-h7ch/GHSA-fvcf-wgxj-h7ch.json → advisories/github-reviewed/2022/05/GHSA-fvcf-wgxj-h7ch/GHSA-fvcf-wgxj-h7ch.json
+13 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fvcf-wgxj-h7ch",
"modified": "2022-05-13T01:31:33Z",
"modified": "2024-01-30T22:26:32Z",
"published": "2022-05-13T01:31:33Z",
"aliases": [
"CVE-2019-10292"
],
"summary": "CSRF vulnerability in Jenkins Nomad Plugin allow SSRF",
"details": "A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers to initiate a connection to an attacker-specified server.",
"severity": [
{
@@ -14,7 +15,15 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "rg.jenkins-ci.plugins:kmap-jenkins"
},
"versions": [
"1.6"
]
}
],
"references": [
{
@@ -39,8 +48,8 @@
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:26:32Z",
"nvd_published_at": "2019-04-04T16:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-g3rg-cj5x-3vpf/GHSA-g3rg-cj5x-3vpf.json → advisories/github-reviewed/2022/05/GHSA-g3rg-cj5x-3vpf/GHSA-g3rg-cj5x-3vpf.json
+23 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g3rg-cj5x-3vpf",
"modified": "2022-05-13T01:31:33Z",
"modified": "2024-01-30T22:26:13Z",
"published": "2022-05-13T01:31:33Z",
"aliases": [
"CVE-2019-10278"
],
"summary": "CSRF vulnerability in jenkins-reviewbot Plugin",
"details": "A cross-site request forgery vulnerability in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:jenkins-reviewbot"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.4.6"
}
]
}
]
}
],
"references": [
{
@@ -39,8 +58,8 @@
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:26:13Z",
"nvd_published_at": "2019-04-04T16:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-mmrv-3cqg-hpf9/GHSA-mmrv-3cqg-hpf9.json → advisories/github-reviewed/2022/05/GHSA-mmrv-3cqg-hpf9/GHSA-mmrv-3cqg-hpf9.json
+30 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mmrv-3cqg-hpf9",
"modified": "2022-05-13T01:31:35Z",
"modified": "2024-01-30T22:25:59Z",
"published": "2022-05-13T01:31:35Z",
"aliases": [
"CVE-2019-1003007"
],
"summary": "Sandbox Bypass via CSRF in Jenkins Warnings Plugin ",
"details": "A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.",
"severity": [
{
@@ -14,13 +15,38 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jvnet.hudson.plugins:warnings"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.1"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 5.0.0"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003007"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/warnings-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1295%20%281%29"
@@ -35,8 +61,8 @@
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:25:59Z",
"nvd_published_at": "2019-02-06T16:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-qrh2-mh97-pw8p/GHSA-qrh2-mh97-pw8p.json → advisories/github-reviewed/2022/05/GHSA-qrh2-mh97-pw8p/GHSA-qrh2-mh97-pw8p.json
+23 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qrh2-mh97-pw8p",
"modified": "2022-05-13T01:25:43Z",
"modified": "2024-01-30T22:25:32Z",
"published": "2022-05-13T01:25:43Z",
"aliases": [
"CVE-2019-1003076"
],
"summary": "CSRF vulnerability in Jenkins Audit to Database Plugin",
"details": "A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attackers to initiate a connection to an attacker-specified server.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:audit2db"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.5"
}
]
}
]
}
],
"references": [
{
@@ -39,8 +58,8 @@
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:25:32Z",
"nvd_published_at": "2019-04-04T16:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-wxj2-qc9p-65r3/GHSA-wxj2-qc9p-65r3.json → advisories/github-reviewed/2022/05/GHSA-wxj2-qc9p-65r3/GHSA-wxj2-qc9p-65r3.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wxj2-qc9p-65r3",
"modified": "2022-05-13T01:31:34Z",
"modified": "2024-01-30T22:27:01Z",
"published": "2022-05-13T01:31:34Z",
"aliases": [
"CVE-2019-1003026"
],
"summary": "Jenkins Mattermost Notification Plugin vulnerable to SSRF",
"details": "A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and room and send a message.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:mattermost"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.3"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.6.2"
}
}
],
"references": [
{
@@ -35,8 +57,8 @@
"CWE-918"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:27:01Z",
"nvd_published_at": "2019-02-20T21:29:00Z"
}
}