netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3269-jqp5-v8c9
GHSA-37wm-28rm-56vw
GHSA-3rwx-3vwh-mwxc
GHSA-9h85-v6xf-h26q
GHSA-3269-jqp5-v8c9
GHSA-37wm-28rm-56vw
GHSA-3rwx-3vwh-mwxc
GHSA-9h85-v6xf-h26q
This commit is contained in:
advisory-database[bot]
2025-03-13 19:15:25 +00:00
parent b2fdc73e0a
commit 89327b709f
8 changed files with 376 additions and 168 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-3269-jqp5-v8c9/GHSA-3269-jqp5-v8c9.json
+96
View File
@@ -0,0 +1,96 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3269-jqp5-v8c9",
"modified": "2025-03-13T19:12:48Z",
"published": "2022-05-17T03:53:16Z",
"aliases": [
"CVE-2015-1814"
],
"summary": "Jenkins allows for Privilege Escalation by Remote Authenticated Users",
"details": "The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a \"forced API token change\" involving anonymous users.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.597"
},
{
"fixed": "1.606"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.596.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1814"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/57e78880cc035874bda916ef4d8d7fd7642af9db"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205616"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T19:12:48Z",
"nvd_published_at": "2015-10-16T20:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-37wm-28rm-56vw/GHSA-37wm-28rm-56vw.json
+92
View File
@@ -0,0 +1,92 @@
{
"schema_version": "1.4.0",
"id": "GHSA-37wm-28rm-56vw",
"modified": "2025-03-13T19:14:50Z",
"published": "2022-05-17T03:53:32Z",
"aliases": [
"CVE-2015-1810"
],
"summary": "Jenkins does not Restrict Reserved Names Allowing for Privilege Escalation ",
"details": "The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the \"Jenkins' own user database\" setting, which allows remote attackers to gain privileges by creating a reserved name.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.597"
},
{
"fixed": "1.600"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.596.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1810"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205627"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T19:14:50Z",
"nvd_published_at": "2015-10-16T20:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-3rwx-3vwh-mwxc/GHSA-3rwx-3vwh-mwxc.json
+92
View File
@@ -0,0 +1,92 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3rwx-3vwh-mwxc",
"modified": "2025-03-13T19:13:02Z",
"published": "2022-05-17T03:53:16Z",
"aliases": [
"CVE-2015-1808"
],
"summary": "Jenkins Vulnerable to Denial of Service (DoS)",
"details": "Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.597"
},
{
"fixed": "1.600"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.596.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1808"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205623"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T19:13:02Z",
"nvd_published_at": "2015-10-16T20:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-9h85-v6xf-h26q/GHSA-9h85-v6xf-h26q.json
+96
View File
@@ -0,0 +1,96 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9h85-v6xf-h26q",
"modified": "2025-03-13T19:14:35Z",
"published": "2022-05-17T03:53:31Z",
"aliases": [
"CVE-2015-1813"
],
"summary": "Jenkins allows Cross-Site Scripting (XSS)",
"details": "Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1812.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.597"
},
{
"fixed": "1.606"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.596.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1813"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/feb2703adb0c121705e5c8e9ddf8f663b6481cbd"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205615"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T19:14:35Z",
"nvd_published_at": "2015-10-16T20:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-3269-jqp5-v8c9/GHSA-3269-jqp5-v8c9.json
-41
View File
@@ -1,41 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3269-jqp5-v8c9",
"modified": "2022-05-17T03:53:16Z",
"published": "2022-05-17T03:53:16Z",
"aliases": [
"CVE-2015-1814"
],
"details": "The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a \"forced API token change\" involving anonymous users.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1814"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205616"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-10-16T20:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-37wm-28rm-56vw/GHSA-37wm-28rm-56vw.json
-41
View File
@@ -1,41 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-37wm-28rm-56vw",
"modified": "2022-05-17T03:53:32Z",
"published": "2022-05-17T03:53:32Z",
"aliases": [
"CVE-2015-1810"
],
"details": "The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the \"Jenkins' own user database\" setting, which allows remote attackers to gain privileges by creating a reserved name.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1810"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205627"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-10-16T20:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-3rwx-3vwh-mwxc/GHSA-3rwx-3vwh-mwxc.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3rwx-3vwh-mwxc",
"modified": "2022-05-17T03:53:16Z",
"published": "2022-05-17T03:53:16Z",
"aliases": [
"CVE-2015-1808"
],
"details": "Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1808"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205623"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-10-16T20:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-9h85-v6xf-h26q/GHSA-9h85-v6xf-h26q.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9h85-v6xf-h26q",
"modified": "2022-05-17T03:53:31Z",
"published": "2022-05-17T03:53:31Z",
"aliases": [
"CVE-2015-1813"
],
"details": "Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1812.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1813"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:0070"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205615"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-10-16T20:59:00Z"
}
}