diff --git a/advisories/unreviewed/2022/04/GHSA-pchp-c5w8-47gc/GHSA-pchp-c5w8-47gc.json b/advisories/github-reviewed/2022/04/GHSA-pchp-c5w8-47gc/GHSA-pchp-c5w8-47gc.json similarity index 55% rename from advisories/unreviewed/2022/04/GHSA-pchp-c5w8-47gc/GHSA-pchp-c5w8-47gc.json rename to advisories/github-reviewed/2022/04/GHSA-pchp-c5w8-47gc/GHSA-pchp-c5w8-47gc.json index 7345169ef52..bbb6d7046e2 100644 --- a/advisories/unreviewed/2022/04/GHSA-pchp-c5w8-47gc/GHSA-pchp-c5w8-47gc.json +++ b/advisories/github-reviewed/2022/04/GHSA-pchp-c5w8-47gc/GHSA-pchp-c5w8-47gc.json @@ -1,17 +1,58 @@ { "schema_version": "1.4.0", "id": "GHSA-pchp-c5w8-47gc", - "modified": "2022-04-23T00:40:48Z", + "modified": "2024-01-30T21:09:35Z", "published": "2022-04-23T00:40:48Z", "aliases": [ "CVE-2012-0785" ], + "summary": "Hash collision attack vulnerability in Jenkins", "details": "Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka \"the Hash DoS attack.\"", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.425" + }, + { + "fixed": "1.447" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.424.2" + } + ] + } + ] + } ], "references": [ { @@ -44,8 +85,8 @@ ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:09:35Z", "nvd_published_at": "2020-02-24T17:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-gvhp-v4m2-3rwf/GHSA-gvhp-v4m2-3rwf.json b/advisories/github-reviewed/2022/05/GHSA-gvhp-v4m2-3rwf/GHSA-gvhp-v4m2-3rwf.json similarity index 66% rename from advisories/unreviewed/2022/05/GHSA-gvhp-v4m2-3rwf/GHSA-gvhp-v4m2-3rwf.json rename to advisories/github-reviewed/2022/05/GHSA-gvhp-v4m2-3rwf/GHSA-gvhp-v4m2-3rwf.json index 5ff80f04a42..517a3865d4d 100644 --- a/advisories/unreviewed/2022/05/GHSA-gvhp-v4m2-3rwf/GHSA-gvhp-v4m2-3rwf.json +++ b/advisories/github-reviewed/2022/05/GHSA-gvhp-v4m2-3rwf/GHSA-gvhp-v4m2-3rwf.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-gvhp-v4m2-3rwf", - "modified": "2022-05-13T01:15:02Z", + "modified": "2024-01-30T21:09:20Z", "published": "2022-05-13T01:15:02Z", "aliases": [ "CVE-2019-10277" ], + "summary": "Jenkins StarTeam Plugin stores credentials in plain text ", "details": "Jenkins StarTeam Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "hudson.plugins:starteam" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.6.13" + } + ] + } + ] + } ], "references": [ { @@ -39,8 +58,8 @@ "CWE-522" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:09:20Z", "nvd_published_at": "2019-04-04T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-wmq3-24jm-m8xh/GHSA-wmq3-24jm-m8xh.json b/advisories/github-reviewed/2022/05/GHSA-wmq3-24jm-m8xh/GHSA-wmq3-24jm-m8xh.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-wmq3-24jm-m8xh/GHSA-wmq3-24jm-m8xh.json rename to advisories/github-reviewed/2022/05/GHSA-wmq3-24jm-m8xh/GHSA-wmq3-24jm-m8xh.json index b1f76e57cfa..4f9546f291b 100644 --- a/advisories/unreviewed/2022/05/GHSA-wmq3-24jm-m8xh/GHSA-wmq3-24jm-m8xh.json +++ b/advisories/github-reviewed/2022/05/GHSA-wmq3-24jm-m8xh/GHSA-wmq3-24jm-m8xh.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-wmq3-24jm-m8xh", - "modified": "2022-05-13T01:15:01Z", + "modified": "2024-01-30T21:09:04Z", "published": "2022-05-13T01:15:01Z", "aliases": [ "CVE-2019-10280" ], + "summary": "Jenkins Assembla Auth Plugin stores credentials in plain text ", "details": "Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:assembla-auth" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.13" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.11" + } + } ], "references": [ { @@ -39,8 +61,8 @@ "CWE-522" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:09:04Z", "nvd_published_at": "2019-04-04T16:29:00Z" } } \ No newline at end of file