diff --git a/advisories/unreviewed/2022/05/GHSA-3892-qqv6-h2qm/GHSA-3892-qqv6-h2qm.json b/advisories/github-reviewed/2022/05/GHSA-3892-qqv6-h2qm/GHSA-3892-qqv6-h2qm.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-3892-qqv6-h2qm/GHSA-3892-qqv6-h2qm.json rename to advisories/github-reviewed/2022/05/GHSA-3892-qqv6-h2qm/GHSA-3892-qqv6-h2qm.json index 20ca42e366f..77219359d57 100644 --- a/advisories/unreviewed/2022/05/GHSA-3892-qqv6-h2qm/GHSA-3892-qqv6-h2qm.json +++ b/advisories/github-reviewed/2022/05/GHSA-3892-qqv6-h2qm/GHSA-3892-qqv6-h2qm.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-3892-qqv6-h2qm", - "modified": "2022-05-14T03:18:39Z", + "modified": "2024-01-30T22:42:18Z", "published": "2022-05-14T03:18:39Z", "aliases": [ "CVE-2018-1000177" ], + "summary": "Stored XSS vulnerability in Jenkins S3 Publisher Plugin", "details": "A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in another user's browser when that user performs some UI actions.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:s3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.11.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.10.12" + } + } ], "references": [ { @@ -31,8 +53,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:42:10Z", "nvd_published_at": "2018-05-08T15:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-j2h6-j34w-g5vp/GHSA-j2h6-j34w-g5vp.json b/advisories/github-reviewed/2022/05/GHSA-j2h6-j34w-g5vp/GHSA-j2h6-j34w-g5vp.json similarity index 63% rename from advisories/unreviewed/2022/05/GHSA-j2h6-j34w-g5vp/GHSA-j2h6-j34w-g5vp.json rename to advisories/github-reviewed/2022/05/GHSA-j2h6-j34w-g5vp/GHSA-j2h6-j34w-g5vp.json index 69477e46740..45e4c828484 100644 --- a/advisories/unreviewed/2022/05/GHSA-j2h6-j34w-g5vp/GHSA-j2h6-j34w-g5vp.json +++ b/advisories/github-reviewed/2022/05/GHSA-j2h6-j34w-g5vp/GHSA-j2h6-j34w-g5vp.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-j2h6-j34w-g5vp", - "modified": "2022-05-14T03:45:49Z", + "modified": "2024-01-30T22:40:52Z", "published": "2022-05-14T03:45:49Z", "aliases": [ "CVE-2018-1000013" ], + "summary": "CSRF vulnerability in Jenkins Release plugin", "details": "Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to trigger release builds.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:release" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10" + } + ] + } + ] + } ], "references": [ { @@ -35,8 +54,8 @@ "CWE-352" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:40:52Z", "nvd_published_at": "2018-01-23T14:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-p498-rpcw-3578/GHSA-p498-rpcw-3578.json b/advisories/github-reviewed/2022/05/GHSA-p498-rpcw-3578/GHSA-p498-rpcw-3578.json similarity index 60% rename from advisories/unreviewed/2022/05/GHSA-p498-rpcw-3578/GHSA-p498-rpcw-3578.json rename to advisories/github-reviewed/2022/05/GHSA-p498-rpcw-3578/GHSA-p498-rpcw-3578.json index 57cae598f54..54d59da2ffd 100644 --- a/advisories/unreviewed/2022/05/GHSA-p498-rpcw-3578/GHSA-p498-rpcw-3578.json +++ b/advisories/github-reviewed/2022/05/GHSA-p498-rpcw-3578/GHSA-p498-rpcw-3578.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-p498-rpcw-3578", - "modified": "2022-05-14T03:45:49Z", + "modified": "2024-01-30T22:41:12Z", "published": "2022-05-14T03:45:49Z", "aliases": [ "CVE-2018-1000012" ], + "summary": "XXE vulnerability Jenkins Warnings Plugin", "details": "Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jvnet.hudson.plugins:warnings" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.65" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.64" + } + } ], "references": [ { @@ -31,8 +53,8 @@ "CWE-611" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:41:12Z", "nvd_published_at": "2018-01-23T14:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-pwvj-6phx-qv8c/GHSA-pwvj-6phx-qv8c.json b/advisories/github-reviewed/2022/05/GHSA-pwvj-6phx-qv8c/GHSA-pwvj-6phx-qv8c.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-pwvj-6phx-qv8c/GHSA-pwvj-6phx-qv8c.json rename to advisories/github-reviewed/2022/05/GHSA-pwvj-6phx-qv8c/GHSA-pwvj-6phx-qv8c.json index e05f8fc40fa..b6562dfa1f7 100644 --- a/advisories/unreviewed/2022/05/GHSA-pwvj-6phx-qv8c/GHSA-pwvj-6phx-qv8c.json +++ b/advisories/github-reviewed/2022/05/GHSA-pwvj-6phx-qv8c/GHSA-pwvj-6phx-qv8c.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-pwvj-6phx-qv8c", - "modified": "2022-05-14T03:45:49Z", + "modified": "2024-01-30T22:40:37Z", "published": "2022-05-14T03:45:49Z", "aliases": [ "CVE-2018-1000014" ], + "summary": "CSRF vulnerability in Jenkins Translation Assistance plugin", "details": "Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to override localized strings displayed to all users on the current Jenkins instance if the victim is a Jenkins administrator.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:translation" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.16" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.15" + } + } ], "references": [ { @@ -35,8 +57,8 @@ "CWE-352" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:40:37Z", "nvd_published_at": "2018-01-23T14:29:00Z" } } \ No newline at end of file