netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3892-qqv6-h2qm
GHSA-j2h6-j34w-g5vp
GHSA-p498-rpcw-3578
GHSA-pwvj-6phx-qv8c
This commit is contained in:
advisory-database[bot]
2024-01-30 22:42:45 +00:00
parent 7cf1083750
commit 48ac4007fe
4 changed files with 101 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-3892-qqv6-h2qm/GHSA-3892-qqv6-h2qm.json → advisories/github-reviewed/2022/05/GHSA-3892-qqv6-h2qm/GHSA-3892-qqv6-h2qm.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3892-qqv6-h2qm",
"modified": "2022-05-14T03:18:39Z",
"modified": "2024-01-30T22:42:18Z",
"published": "2022-05-14T03:18:39Z",
"aliases": [
"CVE-2018-1000177"
],
"summary": "Stored XSS vulnerability in Jenkins S3 Publisher Plugin",
"details": "A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in another user's browser when that user performs some UI actions.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:s3"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 0.10.12"
}
}
],
"references": [
{
@@ -31,8 +53,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:42:10Z",
"nvd_published_at": "2018-05-08T15:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-j2h6-j34w-g5vp/GHSA-j2h6-j34w-g5vp.json → advisories/github-reviewed/2022/05/GHSA-j2h6-j34w-g5vp/GHSA-j2h6-j34w-g5vp.json
+23 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j2h6-j34w-g5vp",
"modified": "2022-05-14T03:45:49Z",
"modified": "2024-01-30T22:40:52Z",
"published": "2022-05-14T03:45:49Z",
"aliases": [
"CVE-2018-1000013"
],
"summary": "CSRF vulnerability in Jenkins Release plugin",
"details": "Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to trigger release builds.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:release"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10"
}
]
}
]
}
],
"references": [
{
@@ -35,8 +54,8 @@
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:40:52Z",
"nvd_published_at": "2018-01-23T14:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-p498-rpcw-3578/GHSA-p498-rpcw-3578.json → advisories/github-reviewed/2022/05/GHSA-p498-rpcw-3578/GHSA-p498-rpcw-3578.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p498-rpcw-3578",
"modified": "2022-05-14T03:45:49Z",
"modified": "2024-01-30T22:41:12Z",
"published": "2022-05-14T03:45:49Z",
"aliases": [
"CVE-2018-1000012"
],
"summary": "XXE vulnerability Jenkins Warnings Plugin",
"details": "Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jvnet.hudson.plugins:warnings"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.65"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 4.64"
}
}
],
"references": [
{
@@ -31,8 +53,8 @@
"CWE-611"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:41:12Z",
"nvd_published_at": "2018-01-23T14:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-pwvj-6phx-qv8c/GHSA-pwvj-6phx-qv8c.json → advisories/github-reviewed/2022/05/GHSA-pwvj-6phx-qv8c/GHSA-pwvj-6phx-qv8c.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pwvj-6phx-qv8c",
"modified": "2022-05-14T03:45:49Z",
"modified": "2024-01-30T22:40:37Z",
"published": "2022-05-14T03:45:49Z",
"aliases": [
"CVE-2018-1000014"
],
"summary": "CSRF vulnerability in Jenkins Translation Assistance plugin",
"details": "Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to override localized strings displayed to all users on the current Jenkins instance if the victim is a Jenkins administrator.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:translation"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.16"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 1.15"
}
}
],
"references": [
{
@@ -35,8 +57,8 @@
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:40:37Z",
"nvd_published_at": "2018-01-23T14:29:00Z"
}
}