diff --git a/advisories/github-reviewed/2022/05/GHSA-3wmv-7php-rhg5/GHSA-3wmv-7php-rhg5.json b/advisories/github-reviewed/2022/05/GHSA-3wmv-7php-rhg5/GHSA-3wmv-7php-rhg5.json new file mode 100644 index 00000000000..c6e62336f50 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-3wmv-7php-rhg5/GHSA-3wmv-7php-rhg5.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3wmv-7php-rhg5", + "modified": "2025-03-13T17:52:47Z", + "published": "2022-05-13T01:30:06Z", + "aliases": [ + "CVE-2015-5318" + ], + "summary": "Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack", + "details": "Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.625.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.626" + }, + { + "fixed": "1.638" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5318" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/f53802bb82a25b295b6dfa3bf2a591a6c8552183" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" + }, + { + "type": "WEB", + "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T17:52:47Z", + "nvd_published_at": "2015-11-25T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-449q-v4j2-5h8p/GHSA-449q-v4j2-5h8p.json b/advisories/github-reviewed/2022/05/GHSA-449q-v4j2-5h8p/GHSA-449q-v4j2-5h8p.json new file mode 100644 index 00000000000..bb2d5bcea3e --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-449q-v4j2-5h8p/GHSA-449q-v4j2-5h8p.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-449q-v4j2-5h8p", + "modified": "2025-03-13T17:53:08Z", + "published": "2022-05-13T01:30:06Z", + "aliases": [ + "CVE-2015-5320" + ], + "summary": "Jenkins allows Exposure of Sensitive Information to an Unauthorized Actor", + "details": "Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.626" + }, + { + "fixed": "1.638" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.625.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5320" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" + }, + { + "type": "WEB", + "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T17:53:08Z", + "nvd_published_at": "2015-11-25T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-5mwr-jg3r-jv66/GHSA-5mwr-jg3r-jv66.json b/advisories/github-reviewed/2022/05/GHSA-5mwr-jg3r-jv66/GHSA-5mwr-jg3r-jv66.json new file mode 100644 index 00000000000..90d205f6184 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-5mwr-jg3r-jv66/GHSA-5mwr-jg3r-jv66.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5mwr-jg3r-jv66", + "modified": "2025-03-13T17:52:57Z", + "published": "2022-05-13T01:30:06Z", + "aliases": [ + "CVE-2015-5326" + ], + "summary": "Jenkins allows Cross-Site Scripting (XSS)", + "details": "Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.625.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.626" + }, + { + "fixed": "1.638" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5326" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/abe561499bbba2e725804c1117fc957028bbd608" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" + }, + { + "type": "WEB", + "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T17:52:57Z", + "nvd_published_at": "2015-11-25T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-x2q2-8pwq-fr5r/GHSA-x2q2-8pwq-fr5r.json b/advisories/github-reviewed/2022/05/GHSA-x2q2-8pwq-fr5r/GHSA-x2q2-8pwq-fr5r.json new file mode 100644 index 00000000000..b41d9058612 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-x2q2-8pwq-fr5r/GHSA-x2q2-8pwq-fr5r.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x2q2-8pwq-fr5r", + "modified": "2025-03-13T17:52:25Z", + "published": "2022-05-13T01:30:06Z", + "aliases": [ + "CVE-2015-5325" + ], + "summary": "Jenkins allows Bypass of Access Restrictions", + "details": "Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.625.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.626" + }, + { + "fixed": "1.638" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5325" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/054a329c59171ca12ff98f7063ce7fd053ee08bf" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" + }, + { + "type": "WEB", + "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T17:52:24Z", + "nvd_published_at": "2015-11-25T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-x4m5-j4x4-4wjg/GHSA-x4m5-j4x4-4wjg.json b/advisories/github-reviewed/2022/05/GHSA-x4m5-j4x4-4wjg/GHSA-x4m5-j4x4-4wjg.json new file mode 100644 index 00000000000..b1515670b45 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-x4m5-j4x4-4wjg/GHSA-x4m5-j4x4-4wjg.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x4m5-j4x4-4wjg", + "modified": "2025-03-13T17:52:36Z", + "published": "2022-05-13T01:30:06Z", + "aliases": [ + "CVE-2015-5323" + ], + "summary": "Jenkins allows Administrators to Access API Tokens", + "details": "Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.625.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.626" + }, + { + "fixed": "1.638" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5323" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/b3f16489ad5f15c3e749ed066cf6b4251f6668c6" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" + }, + { + "type": "WEB", + "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-522" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T17:52:36Z", + "nvd_published_at": "2015-11-25T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-3wmv-7php-rhg5/GHSA-3wmv-7php-rhg5.json b/advisories/unreviewed/2022/05/GHSA-3wmv-7php-rhg5/GHSA-3wmv-7php-rhg5.json deleted file mode 100644 index 976c1951168..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-3wmv-7php-rhg5/GHSA-3wmv-7php-rhg5.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-3wmv-7php-rhg5", - "modified": "2022-05-13T01:30:06Z", - "published": "2022-05-13T01:30:06Z", - "aliases": [ - "CVE-2015-5318" - ], - "details": "Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5318" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" - }, - { - "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2015-11-25T20:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-449q-v4j2-5h8p/GHSA-449q-v4j2-5h8p.json b/advisories/unreviewed/2022/05/GHSA-449q-v4j2-5h8p/GHSA-449q-v4j2-5h8p.json deleted file mode 100644 index b6ec24f5371..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-449q-v4j2-5h8p/GHSA-449q-v4j2-5h8p.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-449q-v4j2-5h8p", - "modified": "2022-05-13T01:30:06Z", - "published": "2022-05-13T01:30:06Z", - "aliases": [ - "CVE-2015-5320" - ], - "details": "Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5320" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" - }, - { - "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2015-11-25T20:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5mwr-jg3r-jv66/GHSA-5mwr-jg3r-jv66.json b/advisories/unreviewed/2022/05/GHSA-5mwr-jg3r-jv66/GHSA-5mwr-jg3r-jv66.json deleted file mode 100644 index c29e972ed01..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-5mwr-jg3r-jv66/GHSA-5mwr-jg3r-jv66.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-5mwr-jg3r-jv66", - "modified": "2022-05-13T01:30:06Z", - "published": "2022-05-13T01:30:06Z", - "aliases": [ - "CVE-2015-5326" - ], - "details": "Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5326" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" - }, - { - "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2015-11-25T20:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-x2q2-8pwq-fr5r/GHSA-x2q2-8pwq-fr5r.json b/advisories/unreviewed/2022/05/GHSA-x2q2-8pwq-fr5r/GHSA-x2q2-8pwq-fr5r.json deleted file mode 100644 index aa084bf9337..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-x2q2-8pwq-fr5r/GHSA-x2q2-8pwq-fr5r.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-x2q2-8pwq-fr5r", - "modified": "2022-05-13T01:30:06Z", - "published": "2022-05-13T01:30:06Z", - "aliases": [ - "CVE-2015-5325" - ], - "details": "Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5325" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" - }, - { - "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-284" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2015-11-25T20:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-x4m5-j4x4-4wjg/GHSA-x4m5-j4x4-4wjg.json b/advisories/unreviewed/2022/05/GHSA-x4m5-j4x4-4wjg/GHSA-x4m5-j4x4-4wjg.json deleted file mode 100644 index ef37c9bf1c8..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-x4m5-j4x4-4wjg/GHSA-x4m5-j4x4-4wjg.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-x4m5-j4x4-4wjg", - "modified": "2022-05-13T01:30:06Z", - "published": "2022-05-13T01:30:06Z", - "aliases": [ - "CVE-2015-5323" - ], - "details": "Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5323" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" - }, - { - "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2015-11-25T20:59:00Z" - } -} \ No newline at end of file