Publish Advisories

GHSA-pgpj-v85q-h5fm
GHSA-qjpf-2jhx-3758
GHSA-v4xv-795h-rv4h
GHSA-x22x-5pp9-8v7f

advisories/github-reviewed/2024/01/GHSA-pgpj-v85q-h5fm/GHSA-pgpj-v85q-h5fm.json

@@ -55,6 +55,10 @@
     {
       "type": "PACKAGE",
       "url": "https://github.com/pyload/pyload"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2024-17.yaml"
     }
   ],
   "database_specific": {

advisories/github-reviewed/2024/01/GHSA-qjpf-2jhx-3758/GHSA-qjpf-2jhx-3758.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-qjpf-2jhx-3758",
-  "modified": "2024-01-24T21:51:30Z",
+  "modified": "2024-01-29T21:53:55Z",
   "published": "2024-01-24T18:31:02Z",
   "aliases": [
     "CVE-2024-23904"
@@ -9,7 +9,10 @@
   "summary": "Arbitrary file read vulnerability in Jenkins Log Command Plugin",
   "details": "Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read content from arbitrary files on the Jenkins controller file system.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
   ],
   "affected": [
     {

advisories/github-reviewed/2024/01/GHSA-v4xv-795h-rv4h/GHSA-v4xv-795h-rv4h.json

@@ -92,6 +92,10 @@
     {
       "type": "PACKAGE",
       "url": "https://github.com/nautobot/nautobot"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2024-16.yaml"
     }
   ],
   "database_specific": {

advisories/github-reviewed/2024/01/GHSA-x22x-5pp9-8v7f/GHSA-x22x-5pp9-8v7f.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-x22x-5pp9-8v7f",
-  "modified": "2024-01-24T21:51:55Z",
+  "modified": "2024-01-29T21:54:26Z",
   "published": "2024-01-24T18:31:02Z",
   "aliases": [
     "CVE-2024-23905"
@@ -9,7 +9,10 @@
   "summary": "Content-Security-Policy disabled by Red Hat Dependency Analytics Jenkins Plugin",
   "details": "Jenkins sets the Content-Security-Policy header to static files served by Jenkins (specifically DirectoryBrowserSupport), such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified.\n\nRed Hat Dependency Analytics Plugin 0.7.1 and earlier globally disables the Content-Security-Policy header for static files served by Jenkins whenever the 'Invoke Red Hat Dependency Analytics (RHDA)' build step is executed. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.\n",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
     {