netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-47rr-8vrp-9283
GHSA-745w-v492-4fj5
GHSA-c3r5-vxj6-62mc
GHSA-mg72-h5gj-8gg7
GHSA-mqj3-fc39-73fj
This commit is contained in:
advisory-database[bot]
2024-01-30 21:25:16 +00:00
parent bfa9549c0c
commit 73bf3b917c
5 changed files with 126 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-47rr-8vrp-9283/GHSA-47rr-8vrp-9283.json → advisories/github-reviewed/2022/05/GHSA-47rr-8vrp-9283/GHSA-47rr-8vrp-9283.json
+24 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-47rr-8vrp-9283",
"modified": "2023-10-25T18:31:24Z",
"modified": "2024-01-30T21:23:57Z",
"published": "2022-05-24T16:52:45Z",
"aliases": [
"CVE-2019-10375"
],
"summary": "Arbitrary file read vulnerability in Jenkins File System SCM Plugin",
"details": "An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins to obtain the contents of any file on the Jenkins master.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "hudson.plugins.filesystem_scm:filesystem_scm"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1"
}
]
}
]
}
],
"references": [
{
@@ -32,11 +51,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:23:57Z",
"nvd_published_at": "2019-08-07T15:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-745w-v492-4fj5/GHSA-745w-v492-4fj5.json → advisories/github-reviewed/2022/05/GHSA-745w-v492-4fj5/GHSA-745w-v492-4fj5.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-745w-v492-4fj5",
"modified": "2023-10-25T18:31:23Z",
"modified": "2024-01-30T21:24:33Z",
"published": "2022-05-24T16:50:04Z",
"aliases": [
"CVE-2019-10342"
],
"summary": "Missing permission check in Jenkins Docker Plugin",
"details": "A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.jenkins.docker:docker-plugin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.7"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 1.1.6"
}
}
],
"references": [
{
@@ -39,8 +61,8 @@
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:24:33Z",
"nvd_published_at": "2019-07-11T14:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-c3r5-vxj6-62mc/GHSA-c3r5-vxj6-62mc.json → advisories/github-reviewed/2022/05/GHSA-c3r5-vxj6-62mc/GHSA-c3r5-vxj6-62mc.json
+23 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c3r5-vxj6-62mc",
"modified": "2023-10-25T18:31:24Z",
"modified": "2024-01-30T21:23:30Z",
"published": "2022-05-24T16:52:46Z",
"aliases": [
"CVE-2019-10379"
],
"summary": "Jenkins Google Cloud Messaging Notification Plugin stores credentials in plain text ",
"details": "Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:gcm-notification"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0"
}
]
}
]
}
],
"references": [
{
@@ -35,8 +54,8 @@
"CWE-522"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:23:30Z",
"nvd_published_at": "2019-08-07T15:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-mg72-h5gj-8gg7/GHSA-mg72-h5gj-8gg7.json → advisories/github-reviewed/2022/05/GHSA-mg72-h5gj-8gg7/GHSA-mg72-h5gj-8gg7.json
+23 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mg72-h5gj-8gg7",
"modified": "2023-10-25T18:31:24Z",
"modified": "2024-01-30T21:24:16Z",
"published": "2022-05-24T16:52:45Z",
"aliases": [
"CVE-2019-10377"
],
"summary": "Missing permission check in Jenkins Avatar Plugin",
"details": "A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "net.hurstfrost.jenkins:avatar"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "< 1.2"
}
}
],
"references": [
{
@@ -35,8 +54,8 @@
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:24:16Z",
"nvd_published_at": "2019-08-07T15:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-mqj3-fc39-73fj/GHSA-mqj3-fc39-73fj.json → advisories/github-reviewed/2022/05/GHSA-mqj3-fc39-73fj/GHSA-mqj3-fc39-73fj.json
+30 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mqj3-fc39-73fj",
"modified": "2023-10-25T18:31:21Z",
"modified": "2024-01-30T21:24:54Z",
"published": "2022-05-24T22:00:03Z",
"aliases": [
"CVE-2019-10324"
],
"summary": "Cross-site request forgery vulnerability in Jenkins Artifactory Plugin",
"details": "A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform release staging for Gradle and Maven projects, and promote previously staged builds, respectively.",
"severity": [
{
@@ -14,13 +15,38 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:artifactory"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.3"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 3.2.2"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10324"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/artifactory-plugin/commit/687cc2b4e9ad62c0bdcee4afc9e8e90c5089ee58"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1347"
@@ -39,8 +65,8 @@
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:24:54Z",
"nvd_published_at": "2019-05-31T15:29:00Z"
}
}