netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3vhr-f5xr-8vpx
GHSA-8xr3-54w2-8xjp
GHSA-rx4r-gxpc-h85x
GHSA-3vhr-f5xr-8vpx
This commit is contained in:
advisory-database[bot]
2025-03-13 18:02:23 +00:00
parent 9dc24f431a
commit 881eabcc9b
4 changed files with 180 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json
+92
View File
@@ -0,0 +1,92 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3vhr-f5xr-8vpx",
"modified": "2025-03-13T18:00:34Z",
"published": "2022-05-13T01:30:07Z",
"aliases": [
"CVE-2015-7537"
],
"summary": "Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack",
"details": "Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.626"
},
{
"fixed": "1.640"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.625.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7537"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/40a28999e221a209212c30586be9c39049510bd1"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T18:00:34Z",
"nvd_published_at": "2016-02-03T18:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json → advisories/github-reviewed/2022/05/GHSA-8xr3-54w2-8xjp/GHSA-8xr3-54w2-8xjp.json
+33 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8xr3-54w2-8xjp",
"modified": "2022-05-13T01:30:59Z",
"modified": "2025-03-13T18:00:05Z",
"published": "2022-05-13T01:30:59Z",
"aliases": [
"CVE-2016-4987"
],
"summary": "Jenkins Image Gallery Plugin allows Path Traversal",
"details": "Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories and read arbitrary files via unspecified form fields.",
"severity": [
{
@@ -13,12 +14,40 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.tupilabs.image_gallery:image-gallery"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4987"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/image-gallery-plugin/commit/20f02f6d53e642431d5e1181a8e7be7971538d50"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/image-gallery-plugin"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20"
@@ -29,8 +58,8 @@
"CWE-22"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T18:00:05Z",
"nvd_published_at": "2017-02-09T15:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json → advisories/github-reviewed/2022/05/GHSA-rx4r-gxpc-h85x/GHSA-rx4r-gxpc-h85x.json
+55 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rx4r-gxpc-h85x",
"modified": "2022-05-14T03:57:44Z",
"modified": "2025-03-13T18:00:43Z",
"published": "2022-05-14T03:57:44Z",
"aliases": [
"CVE-2016-3726"
],
"summary": "Jenkins affected by Open Redirect Vulnerability",
"details": "Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to \"scheme-relative\" URLs.",
"severity": [
{
@@ -13,16 +14,63 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.652"
},
{
"fixed": "2.3"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.651.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3726"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/2ed0c046dfbb2003a17df27c53777e72c6eaff25"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1206"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11"
@@ -37,10 +85,12 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-601"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T18:00:43Z",
"nvd_published_at": "2016-05-17T14:08:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-3vhr-f5xr-8vpx/GHSA-3vhr-f5xr-8vpx.json
-44
View File
@@ -1,44 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3vhr-f5xr-8vpx",
"modified": "2022-05-13T01:30:07Z",
"published": "2022-05-13T01:30:07Z",
"aliases": [
"CVE-2015-7537"
],
"details": "Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7537"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-02-03T18:59:00Z"
}
}