diff --git a/advisories/unreviewed/2022/05/GHSA-3rrg-p8xc-3457/GHSA-3rrg-p8xc-3457.json b/advisories/github-reviewed/2022/05/GHSA-3rrg-p8xc-3457/GHSA-3rrg-p8xc-3457.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-3rrg-p8xc-3457/GHSA-3rrg-p8xc-3457.json rename to advisories/github-reviewed/2022/05/GHSA-3rrg-p8xc-3457/GHSA-3rrg-p8xc-3457.json index 949fca33a73..dbbc544d980 100644 --- a/advisories/unreviewed/2022/05/GHSA-3rrg-p8xc-3457/GHSA-3rrg-p8xc-3457.json +++ b/advisories/github-reviewed/2022/05/GHSA-3rrg-p8xc-3457/GHSA-3rrg-p8xc-3457.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-3rrg-p8xc-3457", - "modified": "2022-05-14T03:33:40Z", + "modified": "2024-01-30T22:39:03Z", "published": "2022-05-14T03:33:40Z", "aliases": [ "CVE-2018-1000113" ], + "summary": "Stored cross-site scripting vulnerability in Jenkins TestLink Plugin", "details": "A cross-site scripting vulnerability exists in Jenkins TestLink Plugin 2.12 and earlier in TestLinkBuildAction/summary.jelly and others that allow an attacker who can control e.g. TestLink report names to have Jenkins serve arbitrary HTML and JavaScript", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:testlink" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.13" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.12" + } + } ], "references": [ { @@ -31,8 +53,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:39:03Z", "nvd_published_at": "2018-03-13T13:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-774g-r3fm-4v85/GHSA-774g-r3fm-4v85.json b/advisories/github-reviewed/2022/05/GHSA-774g-r3fm-4v85/GHSA-774g-r3fm-4v85.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-774g-r3fm-4v85/GHSA-774g-r3fm-4v85.json rename to advisories/github-reviewed/2022/05/GHSA-774g-r3fm-4v85/GHSA-774g-r3fm-4v85.json index 57d107e2205..351c1baf858 100644 --- a/advisories/unreviewed/2022/05/GHSA-774g-r3fm-4v85/GHSA-774g-r3fm-4v85.json +++ b/advisories/github-reviewed/2022/05/GHSA-774g-r3fm-4v85/GHSA-774g-r3fm-4v85.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-774g-r3fm-4v85", - "modified": "2022-05-17T00:29:02Z", + "modified": "2024-01-30T22:39:23Z", "published": "2022-05-17T00:29:02Z", "aliases": [ "CVE-2017-1000090" ], + "summary": "CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration", "details": "Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access to Jenkins.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:role-strategy" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.5.1" + } + ] + } + ] + } ], "references": [ { @@ -31,8 +50,8 @@ "CWE-352" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:39:23Z", "nvd_published_at": "2017-10-05T01:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-9jrh-hch8-rr5c/GHSA-9jrh-hch8-rr5c.json b/advisories/github-reviewed/2022/05/GHSA-9jrh-hch8-rr5c/GHSA-9jrh-hch8-rr5c.json similarity index 61% rename from advisories/unreviewed/2022/05/GHSA-9jrh-hch8-rr5c/GHSA-9jrh-hch8-rr5c.json rename to advisories/github-reviewed/2022/05/GHSA-9jrh-hch8-rr5c/GHSA-9jrh-hch8-rr5c.json index 330bc806774..b817b2bb5dc 100644 --- a/advisories/unreviewed/2022/05/GHSA-9jrh-hch8-rr5c/GHSA-9jrh-hch8-rr5c.json +++ b/advisories/github-reviewed/2022/05/GHSA-9jrh-hch8-rr5c/GHSA-9jrh-hch8-rr5c.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-9jrh-hch8-rr5c", - "modified": "2022-05-14T03:23:41Z", + "modified": "2024-01-30T22:38:38Z", "published": "2022-05-14T03:23:41Z", "aliases": [ "CVE-2018-1000148" ], + "summary": "Jenkins Copy To Slave Plugin allows access to arbitrary files on the Jenkins controller file system ", "details": "An exposure of sensitive information vulnerability exists in Jenkins Copy To Slave Plugin version 1.4.4 and older in CopyToSlaveBuildWrapper.java that allows attackers with permission to configure jobs to read arbitrary files from the Jenkins master file system.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:copy-to-slave" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.4.4" + } + ] + } + ] + } ], "references": [ { @@ -31,8 +50,8 @@ "CWE-200" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:38:38Z", "nvd_published_at": "2018-04-05T13:29:00Z" } } \ No newline at end of file