diff --git a/advisories/unreviewed/2022/05/GHSA-5v2j-w677-j4mp/GHSA-5v2j-w677-j4mp.json b/advisories/github-reviewed/2022/05/GHSA-5v2j-w677-j4mp/GHSA-5v2j-w677-j4mp.json similarity index 61% rename from advisories/unreviewed/2022/05/GHSA-5v2j-w677-j4mp/GHSA-5v2j-w677-j4mp.json rename to advisories/github-reviewed/2022/05/GHSA-5v2j-w677-j4mp/GHSA-5v2j-w677-j4mp.json index 7e10f85e7ae..d14106e16d7 100644 --- a/advisories/unreviewed/2022/05/GHSA-5v2j-w677-j4mp/GHSA-5v2j-w677-j4mp.json +++ b/advisories/github-reviewed/2022/05/GHSA-5v2j-w677-j4mp/GHSA-5v2j-w677-j4mp.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-5v2j-w677-j4mp", - "modified": "2022-05-13T01:31:34Z", + "modified": "2024-01-30T22:26:51Z", "published": "2022-05-13T01:31:34Z", "aliases": [ "CVE-2019-1003027" ], + "summary": "SSRF vulnerability due to missing permission check in Jenkins OctopusDeploy Plugin ", "details": "A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL and obtain the HTTP response code if successful, and exception error message otherwise.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "hudson.plugins.octopusdeploy:octopusdeploy" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.9.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.8.1" + } + } ], "references": [ { @@ -35,8 +57,8 @@ "CWE-918" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:26:51Z", "nvd_published_at": "2019-02-20T21:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-fvcf-wgxj-h7ch/GHSA-fvcf-wgxj-h7ch.json b/advisories/github-reviewed/2022/05/GHSA-fvcf-wgxj-h7ch/GHSA-fvcf-wgxj-h7ch.json similarity index 75% rename from advisories/unreviewed/2022/05/GHSA-fvcf-wgxj-h7ch/GHSA-fvcf-wgxj-h7ch.json rename to advisories/github-reviewed/2022/05/GHSA-fvcf-wgxj-h7ch/GHSA-fvcf-wgxj-h7ch.json index c000c2068f5..baf05d51039 100644 --- a/advisories/unreviewed/2022/05/GHSA-fvcf-wgxj-h7ch/GHSA-fvcf-wgxj-h7ch.json +++ b/advisories/github-reviewed/2022/05/GHSA-fvcf-wgxj-h7ch/GHSA-fvcf-wgxj-h7ch.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fvcf-wgxj-h7ch", - "modified": "2022-05-13T01:31:33Z", + "modified": "2024-01-30T22:26:32Z", "published": "2022-05-13T01:31:33Z", "aliases": [ "CVE-2019-10292" ], + "summary": "CSRF vulnerability in Jenkins Nomad Plugin allow SSRF", "details": "A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers to initiate a connection to an attacker-specified server.", "severity": [ { @@ -14,7 +15,15 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "rg.jenkins-ci.plugins:kmap-jenkins" + }, + "versions": [ + "1.6" + ] + } ], "references": [ { @@ -39,8 +48,8 @@ "CWE-352" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:26:32Z", "nvd_published_at": "2019-04-04T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-g3rg-cj5x-3vpf/GHSA-g3rg-cj5x-3vpf.json b/advisories/github-reviewed/2022/05/GHSA-g3rg-cj5x-3vpf/GHSA-g3rg-cj5x-3vpf.json similarity index 66% rename from advisories/unreviewed/2022/05/GHSA-g3rg-cj5x-3vpf/GHSA-g3rg-cj5x-3vpf.json rename to advisories/github-reviewed/2022/05/GHSA-g3rg-cj5x-3vpf/GHSA-g3rg-cj5x-3vpf.json index 98e1c98cefc..a4893531010 100644 --- a/advisories/unreviewed/2022/05/GHSA-g3rg-cj5x-3vpf/GHSA-g3rg-cj5x-3vpf.json +++ b/advisories/github-reviewed/2022/05/GHSA-g3rg-cj5x-3vpf/GHSA-g3rg-cj5x-3vpf.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-g3rg-cj5x-3vpf", - "modified": "2022-05-13T01:31:33Z", + "modified": "2024-01-30T22:26:13Z", "published": "2022-05-13T01:31:33Z", "aliases": [ "CVE-2019-10278" ], + "summary": "CSRF vulnerability in jenkins-reviewbot Plugin", "details": "A cross-site request forgery vulnerability in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:jenkins-reviewbot" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.4.6" + } + ] + } + ] + } ], "references": [ { @@ -39,8 +58,8 @@ "CWE-352" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:26:13Z", "nvd_published_at": "2019-04-04T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-mmrv-3cqg-hpf9/GHSA-mmrv-3cqg-hpf9.json b/advisories/github-reviewed/2022/05/GHSA-mmrv-3cqg-hpf9/GHSA-mmrv-3cqg-hpf9.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-mmrv-3cqg-hpf9/GHSA-mmrv-3cqg-hpf9.json rename to advisories/github-reviewed/2022/05/GHSA-mmrv-3cqg-hpf9/GHSA-mmrv-3cqg-hpf9.json index 8ca9104e2e7..f8368678770 100644 --- a/advisories/unreviewed/2022/05/GHSA-mmrv-3cqg-hpf9/GHSA-mmrv-3cqg-hpf9.json +++ b/advisories/github-reviewed/2022/05/GHSA-mmrv-3cqg-hpf9/GHSA-mmrv-3cqg-hpf9.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-mmrv-3cqg-hpf9", - "modified": "2022-05-13T01:31:35Z", + "modified": "2024-01-30T22:25:59Z", "published": "2022-05-13T01:31:35Z", "aliases": [ "CVE-2019-1003007" ], + "summary": "Sandbox Bypass via CSRF in Jenkins Warnings Plugin ", "details": "A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.", "severity": [ { @@ -14,13 +15,38 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jvnet.hudson.plugins:warnings" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.0.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 5.0.0" + } + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003007" }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/warnings-plugin" + }, { "type": "WEB", "url": "https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1295%20%281%29" @@ -35,8 +61,8 @@ "CWE-352" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:25:59Z", "nvd_published_at": "2019-02-06T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-qrh2-mh97-pw8p/GHSA-qrh2-mh97-pw8p.json b/advisories/github-reviewed/2022/05/GHSA-qrh2-mh97-pw8p/GHSA-qrh2-mh97-pw8p.json similarity index 67% rename from advisories/unreviewed/2022/05/GHSA-qrh2-mh97-pw8p/GHSA-qrh2-mh97-pw8p.json rename to advisories/github-reviewed/2022/05/GHSA-qrh2-mh97-pw8p/GHSA-qrh2-mh97-pw8p.json index c5bce3bfa91..bfa7eb29d01 100644 --- a/advisories/unreviewed/2022/05/GHSA-qrh2-mh97-pw8p/GHSA-qrh2-mh97-pw8p.json +++ b/advisories/github-reviewed/2022/05/GHSA-qrh2-mh97-pw8p/GHSA-qrh2-mh97-pw8p.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-qrh2-mh97-pw8p", - "modified": "2022-05-13T01:25:43Z", + "modified": "2024-01-30T22:25:32Z", "published": "2022-05-13T01:25:43Z", "aliases": [ "CVE-2019-1003076" ], + "summary": "CSRF vulnerability in Jenkins Audit to Database Plugin", "details": "A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attackers to initiate a connection to an attacker-specified server.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:audit2db" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.5" + } + ] + } + ] + } ], "references": [ { @@ -39,8 +58,8 @@ "CWE-352" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:25:32Z", "nvd_published_at": "2019-04-04T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-wxj2-qc9p-65r3/GHSA-wxj2-qc9p-65r3.json b/advisories/github-reviewed/2022/05/GHSA-wxj2-qc9p-65r3/GHSA-wxj2-qc9p-65r3.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-wxj2-qc9p-65r3/GHSA-wxj2-qc9p-65r3.json rename to advisories/github-reviewed/2022/05/GHSA-wxj2-qc9p-65r3/GHSA-wxj2-qc9p-65r3.json index ccc0c4f6b6a..44fb62dc91b 100644 --- a/advisories/unreviewed/2022/05/GHSA-wxj2-qc9p-65r3/GHSA-wxj2-qc9p-65r3.json +++ b/advisories/github-reviewed/2022/05/GHSA-wxj2-qc9p-65r3/GHSA-wxj2-qc9p-65r3.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-wxj2-qc9p-65r3", - "modified": "2022-05-13T01:31:34Z", + "modified": "2024-01-30T22:27:01Z", "published": "2022-05-13T01:31:34Z", "aliases": [ "CVE-2019-1003026" ], + "summary": "Jenkins Mattermost Notification Plugin vulnerable to SSRF", "details": "A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and room and send a message.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:mattermost" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.6.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.6.2" + } + } ], "references": [ { @@ -35,8 +57,8 @@ "CWE-918" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:27:01Z", "nvd_published_at": "2019-02-20T21:29:00Z" } } \ No newline at end of file