diff --git a/advisories/github-reviewed/2022/05/GHSA-5c56-g5cq-4gj9/GHSA-5c56-g5cq-4gj9.json b/advisories/github-reviewed/2022/05/GHSA-5c56-g5cq-4gj9/GHSA-5c56-g5cq-4gj9.json new file mode 100644 index 00000000000..49e0581bfda --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-5c56-g5cq-4gj9/GHSA-5c56-g5cq-4gj9.json @@ -0,0 +1,100 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5c56-g5cq-4gj9", + "modified": "2025-03-13T17:50:06Z", + "published": "2022-05-05T02:48:48Z", + "aliases": [ + "CVE-2013-0331" + ], + "summary": "Jenkins Vulnerable to Denial of Service (DoS) via Crafted Payload", + "details": "Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.481" + }, + { + "fixed": "1.502" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.480.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0331" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=914879" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20200229023853/http://www.securityfocus.com/bid/57994" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16" + }, + { + "type": "WEB", + "url": "http://rhn.redhat.com/errata/RHSA-2013-0638.html" + }, + { + "type": "WEB", + "url": "http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2013/02/21/7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T17:50:06Z", + "nvd_published_at": "2013-03-19T14:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-5xmf-9vgr-53mj/GHSA-5xmf-9vgr-53mj.json b/advisories/github-reviewed/2022/05/GHSA-5xmf-9vgr-53mj/GHSA-5xmf-9vgr-53mj.json new file mode 100644 index 00000000000..123214e6fd3 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-5xmf-9vgr-53mj/GHSA-5xmf-9vgr-53mj.json @@ -0,0 +1,100 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5xmf-9vgr-53mj", + "modified": "2025-03-13T17:50:51Z", + "published": "2022-05-13T01:30:06Z", + "aliases": [ + "CVE-2015-5324" + ], + "summary": "Jenkins allows Unauthorized Viewing of Queue API Information", + "details": "Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.626" + }, + { + "fixed": "1.638" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.625.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5324" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/33b55588a6a5f844a59f2cd8940d385c6d412eb5" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/4a72e938d58598cd4bd3caa48ee9e8a3f60c30e4" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/581eb9ceb354b8a55c010d0547ff73cb6fd67a75" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" + }, + { + "type": "WEB", + "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T17:50:50Z", + "nvd_published_at": "2015-11-25T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-89vc-7frq-2rfj/GHSA-89vc-7frq-2rfj.json b/advisories/github-reviewed/2022/05/GHSA-89vc-7frq-2rfj/GHSA-89vc-7frq-2rfj.json new file mode 100644 index 00000000000..b71eb09db8b --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-89vc-7frq-2rfj/GHSA-89vc-7frq-2rfj.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-89vc-7frq-2rfj", + "modified": "2025-03-13T17:50:32Z", + "published": "2022-05-13T01:30:06Z", + "aliases": [ + "CVE-2015-5322" + ], + "summary": "Jenkins has Local File Inclusion Vulnerability", + "details": "Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.626" + }, + { + "fixed": "1.638" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.625.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5322" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/5431e397216b4ab80e58bdabcb06a0066bce6592" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" + }, + { + "type": "WEB", + "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T17:50:32Z", + "nvd_published_at": "2015-11-25T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5c56-g5cq-4gj9/GHSA-5c56-g5cq-4gj9.json b/advisories/unreviewed/2022/05/GHSA-5c56-g5cq-4gj9/GHSA-5c56-g5cq-4gj9.json deleted file mode 100644 index f4ecd726279..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-5c56-g5cq-4gj9/GHSA-5c56-g5cq-4gj9.json +++ /dev/null @@ -1,51 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-5c56-g5cq-4gj9", - "modified": "2022-05-05T02:48:48Z", - "published": "2022-05-05T02:48:48Z", - "aliases": [ - "CVE-2013-0331" - ], - "details": "Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0331" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=914879" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16" - }, - { - "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2013-0638.html" - }, - { - "type": "WEB", - "url": "http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2013/02/21/7" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/57994" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2013-03-19T14:55:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5xmf-9vgr-53mj/GHSA-5xmf-9vgr-53mj.json b/advisories/unreviewed/2022/05/GHSA-5xmf-9vgr-53mj/GHSA-5xmf-9vgr-53mj.json deleted file mode 100644 index 086ca5c2bbb..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-5xmf-9vgr-53mj/GHSA-5xmf-9vgr-53mj.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-5xmf-9vgr-53mj", - "modified": "2022-05-13T01:30:06Z", - "published": "2022-05-13T01:30:06Z", - "aliases": [ - "CVE-2015-5324" - ], - "details": "Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5324" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" - }, - { - "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2015-11-25T20:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-89vc-7frq-2rfj/GHSA-89vc-7frq-2rfj.json b/advisories/unreviewed/2022/05/GHSA-89vc-7frq-2rfj/GHSA-89vc-7frq-2rfj.json deleted file mode 100644 index 42aefc45344..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-89vc-7frq-2rfj/GHSA-89vc-7frq-2rfj.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-89vc-7frq-2rfj", - "modified": "2022-05-13T01:30:06Z", - "published": "2022-05-13T01:30:06Z", - "aliases": [ - "CVE-2015-5322" - ], - "details": "Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5322" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" - }, - { - "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2016-0489.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-22" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2015-11-25T20:59:00Z" - } -} \ No newline at end of file