netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-cp9r-g575-xc5f
GHSA-rf73-97j8-9vqh
GHSA-xrpq-4g9w-qrwj
GHSA-rf73-97j8-9vqh
GHSA-xrpq-4g9w-qrwj
This commit is contained in:
advisory-database[bot]
2025-05-16 14:49:56 +00:00
parent 84abbc20dc
commit 9647f1ab88
5 changed files with 163 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/05/GHSA-cp9r-g575-xc5f/GHSA-cp9r-g575-xc5f.json → advisories/github-reviewed/2025/05/GHSA-cp9r-g575-xc5f/GHSA-cp9r-g575-xc5f.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cp9r-g575-xc5f",
"modified": "2025-05-15T15:31:25Z",
"modified": "2025-05-16T14:48:42Z",
"published": "2025-05-14T21:31:20Z",
"aliases": [
"CVE-2025-47888"
],
"summary": "Jenkins DingTalk Plugin Unconditionally Disables SSL/TLS Certificate and Hostname Validation",
"details": "Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks.",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.jenkins.plugins:dingding-notifications"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.7.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47888"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/dingtalk-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3353"
@@ -29,8 +54,8 @@
"CWE-20"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-05-16T14:48:42Z",
"nvd_published_at": "2025-05-14T21:15:59Z"
}
}
advisories/github-reviewed/2025/05/GHSA-rf73-97j8-9vqh/GHSA-rf73-97j8-9vqh.json
+69
View File
@@ -0,0 +1,69 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rf73-97j8-9vqh",
"modified": "2025-05-16T14:47:41Z",
"published": "2025-05-14T21:31:20Z",
"aliases": [
"CVE-2025-47887"
],
"summary": "Jenkins Cadence vManager Plugin is Missing Permission Checks",
"details": "Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:vmanager-plugin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.1-288.v8804beaacb7f"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47887"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/vmanager-plugin/pull/25"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/vmanager-plugin"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/vmanager-plugin/releases/tag/4.0.1-288.v8804b_ea_a_cb_7f"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3548"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-05-16T14:47:41Z",
"nvd_published_at": "2025-05-14T21:15:59Z"
}
}
advisories/github-reviewed/2025/05/GHSA-xrpq-4g9w-qrwj/GHSA-xrpq-4g9w-qrwj.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xrpq-4g9w-qrwj",
"modified": "2025-05-16T14:46:30Z",
"published": "2025-05-14T21:31:20Z",
"aliases": [
"CVE-2025-47885"
],
"summary": "Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting",
"details": "Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Jenkins Health Advisor server responses.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:cloudbees-jenkins-advisor"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "374.376.v3a41aa142efe"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47885"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/cloudbees-jenkins-advisor-plugin/commit/4b456b3110d1504d7dce8e7fca84c4e8793650e6"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/cloudbees-jenkins-advisor-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3559"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-05-16T14:46:30Z",
"nvd_published_at": "2025-05-14T21:15:59Z"
}
}
advisories/unreviewed/2025/05/GHSA-rf73-97j8-9vqh/GHSA-rf73-97j8-9vqh.json
-29
View File
@@ -1,29 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rf73-97j8-9vqh",
"modified": "2025-05-14T21:31:20Z",
"published": "2025-05-14T21:31:20Z",
"aliases": [
"CVE-2025-47887"
],
"details": "Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47887"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3548"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-14T21:15:59Z"
}
}
advisories/unreviewed/2025/05/GHSA-xrpq-4g9w-qrwj/GHSA-xrpq-4g9w-qrwj.json
-29
View File
@@ -1,29 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xrpq-4g9w-qrwj",
"modified": "2025-05-14T21:31:20Z",
"published": "2025-05-14T21:31:20Z",
"aliases": [
"CVE-2025-47885"
],
"details": "Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Jenkins Health Advisor server responses.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47885"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3559"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-14T21:15:59Z"
}
}