netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3x9h-3p7m-33m7
GHSA-9c26-cf8c-mw43
GHSA-c4fr-gx5w-8qf2
GHSA-q3rp-555r-hh6r
GHSA-jx45-xp6q-cwjc
GHSA-4352-jxwg-88rm
GHSA-3x9h-3p7m-33m7
GHSA-9c26-cf8c-mw43
This commit is contained in:
advisory-database[bot]
2025-03-13 19:20:18 +00:00
parent 36335b3a60
commit 99428b1668
8 changed files with 298 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-3x9h-3p7m-33m7/GHSA-3x9h-3p7m-33m7.json
+61
View File
@@ -0,0 +1,61 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3x9h-3p7m-33m7",
"modified": "2025-03-13T19:18:38Z",
"published": "2022-05-17T04:56:20Z",
"aliases": [
"CVE-2013-5676"
],
"summary": "Jenkins SonarQube Plugin Stores Passwords in Cleartext",
"details": "The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:sonar"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.7"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5676"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/sonarqube-plugin"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2013/Dec/37"
}
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T19:18:38Z",
"nvd_published_at": "2013-12-13T18:55:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-9c26-cf8c-mw43/GHSA-9c26-cf8c-mw43.json
+82
View File
@@ -0,0 +1,82 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9c26-cf8c-mw43",
"modified": "2025-03-13T19:17:40Z",
"published": "2022-05-17T03:53:55Z",
"aliases": [
"CVE-2014-2060"
],
"summary": "Jenkins allows Remote Attackers to Hijack Sessions",
"details": "The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.532.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.533"
},
{
"fixed": "1.551"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2060"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/02/21/2"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T19:17:39Z",
"nvd_published_at": "2014-10-17T15:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-c4fr-gx5w-8qf2/GHSA-c4fr-gx5w-8qf2.json → advisories/github-reviewed/2022/05/GHSA-c4fr-gx5w-8qf2/GHSA-c4fr-gx5w-8qf2.json
+39 -7
View File
@@ -1,14 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c4fr-gx5w-8qf2",
"modified": "2022-05-17T04:44:32Z",
"modified": "2025-03-13T19:18:24Z",
"published": "2022-05-17T04:44:32Z",
"aliases": [
"CVE-2013-6372"
],
"summary": "Jenkins Subversion Plugin Stores Credentials with Base64 Encoding",
"details": "The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.",
"severity": [],
"affected": [],
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:subversion"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.54"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -30,16 +56,22 @@
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1032391"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/subversion-plugin"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-11-20"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"cwe_ids": [
"CWE-326"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T19:18:24Z",
"nvd_published_at": "2014-05-08T14:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-q3rp-555r-hh6r/GHSA-q3rp-555r-hh6r.json → advisories/github-reviewed/2022/05/GHSA-q3rp-555r-hh6r/GHSA-q3rp-555r-hh6r.json
+58 -13
View File
@@ -1,14 +1,59 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q3rp-555r-hh6r",
"modified": "2022-05-17T03:53:56Z",
"modified": "2025-03-13T19:18:15Z",
"published": "2022-05-17T03:53:56Z",
"aliases": [
"CVE-2011-4344"
],
"summary": "Jenkins allows Cross-Site Scripting (XSS)",
"details": "Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.",
"severity": [],
"affected": [],
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.409.3"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.410"
},
{
"fixed": "1.438"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -18,6 +63,14 @@
"type": "WEB",
"url": "https://github.com/jenkinsci/winstone/commit/410ed3001d51c689cf59085b7417466caa2ded7b.patch"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200229031004/https://www.securityfocus.com/bid/50786"
},
{
"type": "WEB",
"url": "http://groups.google.com/group/jenkinsci-advisories/msg/1b94588f90f876b5?dmode=source&output=gplain"
@@ -30,17 +83,9 @@
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/11/23/6"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/46911"
},
{
"type": "WEB",
"url": "http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2011-11-08.cb"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/50786"
}
],
"database_specific": {
@@ -48,8 +93,8 @@
"CWE-79"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T19:18:15Z",
"nvd_published_at": "2011-12-01T11:55:00Z"
}
}
advisories/unreviewed/2025/01/GHSA-jx45-xp6q-cwjc/GHSA-jx45-xp6q-cwjc.json → advisories/github-reviewed/2025/01/GHSA-jx45-xp6q-cwjc/GHSA-jx45-xp6q-cwjc.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jx45-xp6q-cwjc",
"modified": "2025-01-30T21:31:23Z",
"modified": "2025-03-13T19:19:06Z",
"published": "2025-01-30T21:31:23Z",
"aliases": [
"CVE-2025-0142"
],
"summary": "Jenkins Zoom Plugin Stores Sensitive Information in Cleartext",
"details": "Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of information via network access.",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.jenkins.plugins:zoom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0142"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/zoom-plugin"
},
{
"type": "WEB",
"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25001"
@@ -29,8 +54,8 @@
"CWE-312"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T19:19:06Z",
"nvd_published_at": "2025-01-30T20:15:33Z"
}
}
advisories/unreviewed/2025/02/GHSA-4352-jxwg-88rm/GHSA-4352-jxwg-88rm.json → advisories/github-reviewed/2025/02/GHSA-4352-jxwg-88rm/GHSA-4352-jxwg-88rm.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4352-jxwg-88rm",
"modified": "2025-02-04T00:32:03Z",
"modified": "2025-03-13T19:19:18Z",
"published": "2025-02-04T00:32:03Z",
"aliases": [
"CVE-2025-0148"
],
"summary": "Jenkins Zoom Plugin is Missing Password Field Masking",
"details": "Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of information via adjacent network access.",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.jenkins.plugins:zoom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0148"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/zoom-plugin"
},
{
"type": "WEB",
"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25007"
@@ -29,8 +54,8 @@
"CWE-549"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T19:19:18Z",
"nvd_published_at": "2025-02-03T23:15:08Z"
}
}
advisories/unreviewed/2022/05/GHSA-3x9h-3p7m-33m7/GHSA-3x9h-3p7m-33m7.json
-33
View File
@@ -1,33 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3x9h-3p7m-33m7",
"modified": "2022-05-17T04:56:20Z",
"published": "2022-05-17T04:56:20Z",
"aliases": [
"CVE-2013-5676"
],
"details": "The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5676"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2013/Dec/37"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/100666"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-12-13T18:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-9c26-cf8c-mw43/GHSA-9c26-cf8c-mw43.json
-33
View File
@@ -1,33 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9c26-cf8c-mw43",
"modified": "2022-05-17T03:53:55Z",
"published": "2022-05-17T03:53:55Z",
"aliases": [
"CVE-2014-2060"
],
"details": "The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2060"
},
{
"type": "WEB",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/02/21/2"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-10-17T15:55:00Z"
}
}