diff --git a/advisories/unreviewed/2022/05/GHSA-47rr-8vrp-9283/GHSA-47rr-8vrp-9283.json b/advisories/github-reviewed/2022/05/GHSA-47rr-8vrp-9283/GHSA-47rr-8vrp-9283.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-47rr-8vrp-9283/GHSA-47rr-8vrp-9283.json rename to advisories/github-reviewed/2022/05/GHSA-47rr-8vrp-9283/GHSA-47rr-8vrp-9283.json index 84a0960961d..bfc6496c277 100644 --- a/advisories/unreviewed/2022/05/GHSA-47rr-8vrp-9283/GHSA-47rr-8vrp-9283.json +++ b/advisories/github-reviewed/2022/05/GHSA-47rr-8vrp-9283/GHSA-47rr-8vrp-9283.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-47rr-8vrp-9283", - "modified": "2023-10-25T18:31:24Z", + "modified": "2024-01-30T21:23:57Z", "published": "2022-05-24T16:52:45Z", "aliases": [ "CVE-2019-10375" ], + "summary": "Arbitrary file read vulnerability in Jenkins File System SCM Plugin", "details": "An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins to obtain the contents of any file on the Jenkins master.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "hudson.plugins.filesystem_scm:filesystem_scm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.1" + } + ] + } + ] + } ], "references": [ { @@ -32,11 +51,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-22" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:23:57Z", "nvd_published_at": "2019-08-07T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-745w-v492-4fj5/GHSA-745w-v492-4fj5.json b/advisories/github-reviewed/2022/05/GHSA-745w-v492-4fj5/GHSA-745w-v492-4fj5.json similarity index 63% rename from advisories/unreviewed/2022/05/GHSA-745w-v492-4fj5/GHSA-745w-v492-4fj5.json rename to advisories/github-reviewed/2022/05/GHSA-745w-v492-4fj5/GHSA-745w-v492-4fj5.json index 7d4382adb9b..a8372d25003 100644 --- a/advisories/unreviewed/2022/05/GHSA-745w-v492-4fj5/GHSA-745w-v492-4fj5.json +++ b/advisories/github-reviewed/2022/05/GHSA-745w-v492-4fj5/GHSA-745w-v492-4fj5.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-745w-v492-4fj5", - "modified": "2023-10-25T18:31:23Z", + "modified": "2024-01-30T21:24:33Z", "published": "2022-05-24T16:50:04Z", "aliases": [ "CVE-2019-10342" ], + "summary": "Missing permission check in Jenkins Docker Plugin", "details": "A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "io.jenkins.docker:docker-plugin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.1.7" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.1.6" + } + } ], "references": [ { @@ -39,8 +61,8 @@ "CWE-862" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:24:33Z", "nvd_published_at": "2019-07-11T14:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-c3r5-vxj6-62mc/GHSA-c3r5-vxj6-62mc.json b/advisories/github-reviewed/2022/05/GHSA-c3r5-vxj6-62mc/GHSA-c3r5-vxj6-62mc.json similarity index 63% rename from advisories/unreviewed/2022/05/GHSA-c3r5-vxj6-62mc/GHSA-c3r5-vxj6-62mc.json rename to advisories/github-reviewed/2022/05/GHSA-c3r5-vxj6-62mc/GHSA-c3r5-vxj6-62mc.json index cb834f42ee8..3428a1d4ee9 100644 --- a/advisories/unreviewed/2022/05/GHSA-c3r5-vxj6-62mc/GHSA-c3r5-vxj6-62mc.json +++ b/advisories/github-reviewed/2022/05/GHSA-c3r5-vxj6-62mc/GHSA-c3r5-vxj6-62mc.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-c3r5-vxj6-62mc", - "modified": "2023-10-25T18:31:24Z", + "modified": "2024-01-30T21:23:30Z", "published": "2022-05-24T16:52:46Z", "aliases": [ "CVE-2019-10379" ], + "summary": "Jenkins Google Cloud Messaging Notification Plugin stores credentials in plain text ", "details": "Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:gcm-notification" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.0" + } + ] + } + ] + } ], "references": [ { @@ -35,8 +54,8 @@ "CWE-522" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:23:30Z", "nvd_published_at": "2019-08-07T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-mg72-h5gj-8gg7/GHSA-mg72-h5gj-8gg7.json b/advisories/github-reviewed/2022/05/GHSA-mg72-h5gj-8gg7/GHSA-mg72-h5gj-8gg7.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-mg72-h5gj-8gg7/GHSA-mg72-h5gj-8gg7.json rename to advisories/github-reviewed/2022/05/GHSA-mg72-h5gj-8gg7/GHSA-mg72-h5gj-8gg7.json index 025b8a3150f..1d4e61cbee2 100644 --- a/advisories/unreviewed/2022/05/GHSA-mg72-h5gj-8gg7/GHSA-mg72-h5gj-8gg7.json +++ b/advisories/github-reviewed/2022/05/GHSA-mg72-h5gj-8gg7/GHSA-mg72-h5gj-8gg7.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-mg72-h5gj-8gg7", - "modified": "2023-10-25T18:31:24Z", + "modified": "2024-01-30T21:24:16Z", "published": "2022-05-24T16:52:45Z", "aliases": [ "CVE-2019-10377" ], + "summary": "Missing permission check in Jenkins Avatar Plugin", "details": "A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "net.hurstfrost.jenkins:avatar" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 1.2" + } + } ], "references": [ { @@ -35,8 +54,8 @@ "CWE-862" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:24:16Z", "nvd_published_at": "2019-08-07T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-mqj3-fc39-73fj/GHSA-mqj3-fc39-73fj.json b/advisories/github-reviewed/2022/05/GHSA-mqj3-fc39-73fj/GHSA-mqj3-fc39-73fj.json similarity index 61% rename from advisories/unreviewed/2022/05/GHSA-mqj3-fc39-73fj/GHSA-mqj3-fc39-73fj.json rename to advisories/github-reviewed/2022/05/GHSA-mqj3-fc39-73fj/GHSA-mqj3-fc39-73fj.json index 71971192f92..39892e40f94 100644 --- a/advisories/unreviewed/2022/05/GHSA-mqj3-fc39-73fj/GHSA-mqj3-fc39-73fj.json +++ b/advisories/github-reviewed/2022/05/GHSA-mqj3-fc39-73fj/GHSA-mqj3-fc39-73fj.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-mqj3-fc39-73fj", - "modified": "2023-10-25T18:31:21Z", + "modified": "2024-01-30T21:24:54Z", "published": "2022-05-24T22:00:03Z", "aliases": [ "CVE-2019-10324" ], + "summary": "Cross-site request forgery vulnerability in Jenkins Artifactory Plugin", "details": "A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform release staging for Gradle and Maven projects, and promote previously staged builds, respectively.", "severity": [ { @@ -14,13 +15,38 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:artifactory" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.2.2" + } + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10324" }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/artifactory-plugin/commit/687cc2b4e9ad62c0bdcee4afc9e8e90c5089ee58" + }, { "type": "WEB", "url": "https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1347" @@ -39,8 +65,8 @@ "CWE-352" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:24:54Z", "nvd_published_at": "2019-05-31T15:29:00Z" } } \ No newline at end of file