netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-whgj-6m78-2gg9
GHSA-27pr-r7hm-c2rc
GHSA-px39-5h8c-j3c8
GHSA-g4qf-5523-7wvf
GHSA-p986-hpr3-493p
GHSA-27pr-r7hm-c2rc
GHSA-px39-5h8c-j3c8
This commit is contained in:
advisory-database[bot]
2024-01-30 23:04:02 +00:00
parent eb511655c0
commit 8ae86ccdeb
7 changed files with 218 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/06/GHSA-whgj-6m78-2gg9/GHSA-whgj-6m78-2gg9.json → advisories/github-reviewed/2023/06/GHSA-whgj-6m78-2gg9/GHSA-whgj-6m78-2gg9.json
+24 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-whgj-6m78-2gg9",
"modified": "2023-06-23T18:30:21Z",
"modified": "2024-01-30T23:02:44Z",
"published": "2023-06-14T15:30:37Z",
"aliases": [
"CVE-2023-35147"
],
"summary": "Arbitrary file read vulnerability in Jenkins AWS CodeCommit Trigger Plugin",
"details": "Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:aws-codecommit-trigger"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.12"
}
]
}
]
}
],
"references": [
{
@@ -34,9 +53,9 @@
"cwe_ids": [
"CWE-732"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T23:02:36Z",
"nvd_published_at": "2023-06-14T13:15:12Z"
}
}
advisories/github-reviewed/2023/07/GHSA-27pr-r7hm-c2rc/GHSA-27pr-r7hm-c2rc.json
+68
View File
@@ -0,0 +1,68 @@
{
"schema_version": "1.4.0",
"id": "GHSA-27pr-r7hm-c2rc",
"modified": "2024-01-30T23:03:10Z",
"published": "2023-07-19T18:30:55Z",
"aliases": [
"CVE-2023-32261"
],
"summary": "Missing permission check in Jenkins Dimensions Plugin allows enumerating credentials IDs",
"details": "Dimensions Plugin 0.9.3 and earlier does not perform a permission check in an HTTP endpoint.\n\nThis allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.\n\nAn enumeration of credentials IDs in Dimensions Plugin 0.9.3.1 requires the appropriate permissions.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:dimensionsscm"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.3.1"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 0.9.3"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32261"
},
{
"type": "WEB",
"url": "https://plugins.jenkins.io/dimensionsscm/"
},
{
"type": "WEB",
"url": "https://portal.microfocus.com/s/article/KM000019297"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3138"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T23:03:10Z",
"nvd_published_at": "2023-07-19T16:15:09Z"
}
}
advisories/github-reviewed/2023/07/GHSA-px39-5h8c-j3c8/GHSA-px39-5h8c-j3c8.json
+68
View File
@@ -0,0 +1,68 @@
{
"schema_version": "1.4.0",
"id": "GHSA-px39-5h8c-j3c8",
"modified": "2024-01-30T23:03:23Z",
"published": "2023-07-19T18:30:56Z",
"aliases": [
"CVE-2023-32262"
],
"summary": "Exposure of system-scoped credentials in Jenkins Dimensions Plugin",
"details": "Dimensions Plugin 0.9.3 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration.\n\nThis allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.\n\nDimensions Plugin 0.9.3.1 defines the appropriate context for credentials lookup.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:dimensionsscm"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.3.1"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 0.9.3"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32262"
},
{
"type": "WEB",
"url": "https://plugins.jenkins.io/dimensionsscm/"
},
{
"type": "WEB",
"url": "https://portal.microfocus.com/s/article/KM000019298"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3143"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T23:03:23Z",
"nvd_published_at": "2023-07-19T16:15:09Z"
}
}
advisories/unreviewed/2023/09/GHSA-g4qf-5523-7wvf/GHSA-g4qf-5523-7wvf.json → advisories/github-reviewed/2023/09/GHSA-g4qf-5523-7wvf/GHSA-g4qf-5523-7wvf.json
+29 -7
View File
@@ -1,17 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g4qf-5523-7wvf",
"modified": "2023-09-06T15:30:26Z",
"modified": "2024-01-30T23:02:07Z",
"published": "2023-09-06T15:30:26Z",
"aliases": [
"CVE-2023-41944"
],
"summary": "HTML injection vulnerability in Jenkins AWS CodeCommit Trigger Plugin",
"details": "Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:aws-codecommit-trigger"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.12"
}
]
}
]
}
],
"references": [
{
@@ -29,11 +51,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T23:02:07Z",
"nvd_published_at": "2023-09-06T13:15:11Z"
}
}
advisories/unreviewed/2023/09/GHSA-p986-hpr3-493p/GHSA-p986-hpr3-493p.json → advisories/github-reviewed/2023/09/GHSA-p986-hpr3-493p/GHSA-p986-hpr3-493p.json
+29 -7
View File
@@ -1,17 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p986-hpr3-493p",
"modified": "2023-09-06T15:30:26Z",
"modified": "2024-01-30T23:01:54Z",
"published": "2023-09-06T15:30:26Z",
"aliases": [
"CVE-2023-41947"
],
"summary": "Missing permission checks in Jenkins Frugal Testing Plugin",
"details": "A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frugal Testing using attacker-specified credentials.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.jenkins.plugins:frugal-testing"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1"
}
]
}
]
}
],
"references": [
{
@@ -29,11 +51,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T23:01:54Z",
"nvd_published_at": "2023-09-06T13:15:11Z"
}
}
advisories/unreviewed/2023/07/GHSA-27pr-r7hm-c2rc/GHSA-27pr-r7hm-c2rc.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-27pr-r7hm-c2rc",
"modified": "2023-07-19T18:30:55Z",
"published": "2023-07-19T18:30:55Z",
"aliases": [
"CVE-2023-32261"
],
"details": "\nA potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.\nSee the following Jenkins security advisory for details: * https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/ \n\n\n\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32261"
},
{
"type": "WEB",
"url": "https://plugins.jenkins.io/dimensionsscm/"
},
{
"type": "WEB",
"url": "https://portal.microfocus.com/s/article/KM000019297"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-06-14/"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-19T16:15:09Z"
}
}
advisories/unreviewed/2023/07/GHSA-px39-5h8c-j3c8/GHSA-px39-5h8c-j3c8.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-px39-5h8c-j3c8",
"modified": "2023-07-19T18:30:56Z",
"published": "2023-07-19T18:30:56Z",
"aliases": [
"CVE-2023-32262"
],
"details": "\nA potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.\nSee the following Jenkins security advisory for details: * https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/ \n\n\n\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32262"
},
{
"type": "WEB",
"url": "https://plugins.jenkins.io/dimensionsscm/"
},
{
"type": "WEB",
"url": "https://portal.microfocus.com/s/article/KM000019298"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-06-14/"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-19T16:15:09Z"
}
}