netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-8v72-qr3h-c6rv
GHSA-hg2w-3c4j-jjwm
This commit is contained in:
advisory-database[bot]
2023-10-27 13:29:53 +00:00
parent bc9bbbebb5
commit 75c2f01e29
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-8v72-qr3h-c6rv/GHSA-8v72-qr3h-c6rv.json
+4 -4
View File
@@ -1,17 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8v72-qr3h-c6rv",
"modified": "2022-12-13T18:53:54Z",
"modified": "2023-10-27T13:27:53Z",
"published": "2022-05-24T17:39:13Z",
"aliases": [
"CVE-2021-21614"
],
"summary": "Credentials stored in plain text by Jenkins Bumblebee HP ALM Plugin",
"details": "Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file `com.agiletestware.bumblebee.BumblebeeGlobalConfig.xml` on the Jenkins controller as part of its configuration.\n\nThese credentials can be viewed by users with access to the Jenkins controller file system.\n\nBumblebee HP ALM Plugin 4.1.6 stores credentials encrypted once its configuration is saved again.",
"details": "Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file `com.agiletestware.bumblebee.BumblebeeGlobalConfig.xml` on the Jenkins controller as part of its configuration.\n\nThese credentials can be viewed by users with access to the Jenkins controller file system.\n\nJenkins Bumblebee HP ALM Plugin 4.1.6 stores credentials encrypted once its configuration is saved again.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -56,7 +56,7 @@
"cwe_ids": [
"CWE-522"
],
"severity": "LOW",
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2022-12-13T18:53:54Z",
"nvd_published_at": "2021-01-13T16:15:00Z"
advisories/github-reviewed/2022/05/GHSA-hg2w-3c4j-jjwm/GHSA-hg2w-3c4j-jjwm.json
+4 -4
View File
@@ -1,17 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hg2w-3c4j-jjwm",
"modified": "2022-12-13T18:55:30Z",
"modified": "2023-10-27T13:29:06Z",
"published": "2022-05-24T17:43:00Z",
"aliases": [
"CVE-2021-21618"
],
"summary": "Stored XSS vulnerability in Jenkins Repository Connector Plugin",
"details": "Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.\n\nRepository Connector Plugin 2.0.3 escapes parameter names and descriptions when creating new parameters.",
"details": "Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.\n\nJenkins Repository Connector Plugin 2.0.3 escapes parameter names and descriptions when creating new parameters.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -56,7 +56,7 @@
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2022-12-13T18:55:30Z",
"nvd_published_at": "2021-02-24T16:15:00Z"