diff --git a/advisories/unreviewed/2022/05/GHSA-56gj-927p-mfph/GHSA-56gj-927p-mfph.json b/advisories/github-reviewed/2022/05/GHSA-56gj-927p-mfph/GHSA-56gj-927p-mfph.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-56gj-927p-mfph/GHSA-56gj-927p-mfph.json rename to advisories/github-reviewed/2022/05/GHSA-56gj-927p-mfph/GHSA-56gj-927p-mfph.json index cb788e93690..aa05c251733 100644 --- a/advisories/unreviewed/2022/05/GHSA-56gj-927p-mfph/GHSA-56gj-927p-mfph.json +++ b/advisories/github-reviewed/2022/05/GHSA-56gj-927p-mfph/GHSA-56gj-927p-mfph.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-56gj-927p-mfph", - "modified": "2023-10-25T18:31:25Z", + "modified": "2024-01-30T21:19:12Z", "published": "2022-05-24T16:55:59Z", "aliases": [ "CVE-2019-10397" ], + "summary": "Jenkins Aqua Security Serverless Scanner Plugin showed plain text password in job configuration form fields ", "details": "Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "org.jenkins-ci.plugins:aqua-serverless" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.0.4" + } + } ], "references": [ { @@ -35,8 +57,8 @@ "CWE-319" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:19:12Z", "nvd_published_at": "2019-09-12T14:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-65rj-cgrp-g65w/GHSA-65rj-cgrp-g65w.json b/advisories/github-reviewed/2022/05/GHSA-65rj-cgrp-g65w/GHSA-65rj-cgrp-g65w.json similarity index 57% rename from advisories/unreviewed/2022/05/GHSA-65rj-cgrp-g65w/GHSA-65rj-cgrp-g65w.json rename to advisories/github-reviewed/2022/05/GHSA-65rj-cgrp-g65w/GHSA-65rj-cgrp-g65w.json index ee1d378296e..51b7948518c 100644 --- a/advisories/unreviewed/2022/05/GHSA-65rj-cgrp-g65w/GHSA-65rj-cgrp-g65w.json +++ b/advisories/github-reviewed/2022/05/GHSA-65rj-cgrp-g65w/GHSA-65rj-cgrp-g65w.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-65rj-cgrp-g65w", - "modified": "2023-10-25T18:31:25Z", + "modified": "2024-01-30T21:20:03Z", "published": "2022-05-24T16:55:01Z", "aliases": [ "CVE-2019-10391" ], - "details": "Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure.", + "summary": "Jenkins IBM AppScan Plugin showed plain text password in job configuration form fields ", + "details": "Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure. This plugin has bee deprecated.", "severity": [ { "type": "CVSS_V3", @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "com.hcl.security:ibm-application-security" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.2.4" + } + } ], "references": [ { @@ -35,8 +57,8 @@ "CWE-319" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:20:03Z", "nvd_published_at": "2019-08-28T16:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-pv88-89rq-9fg6/GHSA-pv88-89rq-9fg6.json b/advisories/github-reviewed/2022/05/GHSA-pv88-89rq-9fg6/GHSA-pv88-89rq-9fg6.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-pv88-89rq-9fg6/GHSA-pv88-89rq-9fg6.json rename to advisories/github-reviewed/2022/05/GHSA-pv88-89rq-9fg6/GHSA-pv88-89rq-9fg6.json index ecf4a4cf580..84557a1ad09 100644 --- a/advisories/unreviewed/2022/05/GHSA-pv88-89rq-9fg6/GHSA-pv88-89rq-9fg6.json +++ b/advisories/github-reviewed/2022/05/GHSA-pv88-89rq-9fg6/GHSA-pv88-89rq-9fg6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-pv88-89rq-9fg6", - "modified": "2023-10-25T18:31:25Z", + "modified": "2024-01-30T21:20:31Z", "published": "2022-05-24T16:52:46Z", "aliases": [ "CVE-2019-10389" ], + "summary": "Missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin ", "details": "A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified server.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:relution-publisher" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.24" + } + ] + } + ] + } ], "references": [ { @@ -35,8 +54,8 @@ "CWE-862" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:20:31Z", "nvd_published_at": "2019-08-07T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-xj4w-r6gr-x5qm/GHSA-xj4w-r6gr-x5qm.json b/advisories/github-reviewed/2022/05/GHSA-xj4w-r6gr-x5qm/GHSA-xj4w-r6gr-x5qm.json new file mode 100644 index 00000000000..a3d5c3766bf --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-xj4w-r6gr-x5qm/GHSA-xj4w-r6gr-x5qm.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xj4w-r6gr-x5qm", + "modified": "2024-01-30T21:19:03Z", + "published": "2022-05-24T22:00:44Z", + "aliases": [ + "CVE-2019-10407" + ], + "summary": "Project Inheritance Plugin showed secret environment variables defined in Mask Passwords Plugin ", + "details": "Jenkins Project Inheritance Plugin 19.08.02 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "hudson.plugins:project-inheritance" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "19.08.02" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 19.08.01" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10407" + }, + { + "type": "WEB", + "url": "https://jenkins.io/security/advisory/2019-09-25/#SECURITY-351" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2019/09/25/3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:19:03Z", + "nvd_published_at": "2019-09-25T16:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-xj63-95xc-jc4v/GHSA-xj63-95xc-jc4v.json b/advisories/github-reviewed/2022/05/GHSA-xj63-95xc-jc4v/GHSA-xj63-95xc-jc4v.json similarity index 66% rename from advisories/unreviewed/2022/05/GHSA-xj63-95xc-jc4v/GHSA-xj63-95xc-jc4v.json rename to advisories/github-reviewed/2022/05/GHSA-xj63-95xc-jc4v/GHSA-xj63-95xc-jc4v.json index 8c3308ff61d..9e4ba3a2b2e 100644 --- a/advisories/unreviewed/2022/05/GHSA-xj63-95xc-jc4v/GHSA-xj63-95xc-jc4v.json +++ b/advisories/github-reviewed/2022/05/GHSA-xj63-95xc-jc4v/GHSA-xj63-95xc-jc4v.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-xj63-95xc-jc4v", - "modified": "2023-10-25T18:31:24Z", + "modified": "2024-01-30T21:20:20Z", "published": "2022-05-24T16:52:46Z", "aliases": [ "CVE-2019-10385" ], + "summary": "Jenkins eggplant-plugin Plugin stores credentials in plain text ", "details": "Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:eggplant-plugin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.2" + } + ] + } + ] + } ], "references": [ { @@ -39,8 +58,8 @@ "CWE-522" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:20:20Z", "nvd_published_at": "2019-08-07T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-xj4w-r6gr-x5qm/GHSA-xj4w-r6gr-x5qm.json b/advisories/unreviewed/2022/05/GHSA-xj4w-r6gr-x5qm/GHSA-xj4w-r6gr-x5qm.json deleted file mode 100644 index 60d8367b54b..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-xj4w-r6gr-x5qm/GHSA-xj4w-r6gr-x5qm.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xj4w-r6gr-x5qm", - "modified": "2023-02-23T03:30:16Z", - "published": "2022-05-24T22:00:44Z", - "aliases": [ - "CVE-2019-10407" - ], - "details": "Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10407" - }, - { - "type": "WEB", - "url": "https://jenkins.io/security/advisory/2019-09-25/#SECURITY-351" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2019/09/25/3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-09-25T16:15:00Z" - } -} \ No newline at end of file