netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-5532-prrf-rf5x
GHSA-9rx5-w522-5fh7
GHSA-c9px-7j36-f35v
GHSA-crvq-mw2w-4cfx
GHSA-cwxx-gwwj-pqjq
GHSA-h7rx-r733-7x7r
This commit is contained in:
advisory-database[bot]
2024-01-30 22:44:39 +00:00
parent 48ac4007fe
commit e7fc5a5653
6 changed files with 154 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-5532-prrf-rf5x/GHSA-5532-prrf-rf5x.json → advisories/github-reviewed/2022/05/GHSA-5532-prrf-rf5x/GHSA-5532-prrf-rf5x.json
+23 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5532-prrf-rf5x",
"modified": "2022-05-13T01:41:14Z",
"modified": "2024-01-30T22:43:47Z",
"published": "2022-05-13T01:41:14Z",
"aliases": [
"CVE-2017-1000403"
],
"summary": "Arbitrary code execution vulnerability in Jenkins Speaks! Plugin",
"details": "Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM, effectively elevating privileges to Overall/Run Scripts.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jvnet.hudson.plugins:speaks"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.1"
}
]
}
]
}
],
"references": [
{
@@ -31,8 +50,8 @@
"CWE-732"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:43:47Z",
"nvd_published_at": "2018-01-26T02:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-9rx5-w522-5fh7/GHSA-9rx5-w522-5fh7.json → advisories/github-reviewed/2022/05/GHSA-9rx5-w522-5fh7/GHSA-9rx5-w522-5fh7.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9rx5-w522-5fh7",
"modified": "2022-05-13T01:48:32Z",
"modified": "2024-01-30T22:43:31Z",
"published": "2022-05-13T01:48:32Z",
"aliases": [
"CVE-2018-1000114"
],
"summary": "Jenkins Promoted Builds Plugin allowed unauthorized users to run some promotion processes",
"details": "An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java that allow an attacker with read access to jobs to perform promotions.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:promoted-builds"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.31.1"
}
}
],
"references": [
{
@@ -31,8 +53,8 @@
"CWE-863"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:43:31Z",
"nvd_published_at": "2018-03-13T13:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-c9px-7j36-f35v/GHSA-c9px-7j36-f35v.json → advisories/github-reviewed/2022/05/GHSA-c9px-7j36-f35v/GHSA-c9px-7j36-f35v.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c9px-7j36-f35v",
"modified": "2022-05-13T01:48:34Z",
"modified": "2024-01-30T22:42:51Z",
"published": "2022-05-13T01:48:34Z",
"aliases": [
"CVE-2018-1000189"
],
"summary": "CSRF vulnerability and missing permission checks in Jenkins AbsInt Astrée Plugin",
"details": "A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with Overall/Read access to execute a command on the Jenkins master.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:absint-astree"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 1.0.5"
}
}
],
"references": [
{
@@ -31,8 +53,8 @@
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:42:51Z",
"nvd_published_at": "2018-06-05T20:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-crvq-mw2w-4cfx/GHSA-crvq-mw2w-4cfx.json → advisories/github-reviewed/2022/05/GHSA-crvq-mw2w-4cfx/GHSA-crvq-mw2w-4cfx.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-crvq-mw2w-4cfx",
"modified": "2022-05-13T01:48:34Z",
"modified": "2024-01-30T22:42:35Z",
"published": "2022-05-13T01:48:34Z",
"aliases": [
"CVE-2018-1000197"
],
"summary": "Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration",
"details": "An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/Read permission to read and write the Black Duck Hub plugin configuration.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.blackducksoftware.integration:blackduck-hub"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 3.0.3"
}
}
],
"references": [
{
@@ -31,8 +53,8 @@
"CWE-863"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:42:35Z",
"nvd_published_at": "2018-06-05T21:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-cwxx-gwwj-pqjq/GHSA-cwxx-gwwj-pqjq.json → advisories/github-reviewed/2022/05/GHSA-cwxx-gwwj-pqjq/GHSA-cwxx-gwwj-pqjq.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cwxx-gwwj-pqjq",
"modified": "2022-05-13T01:48:33Z",
"modified": "2024-01-30T22:43:17Z",
"published": "2022-05-13T01:48:33Z",
"aliases": [
"CVE-2018-1000145"
],
"summary": "Jenkins Perforce Plugin uses ineffective credentials encryption",
"details": "An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with local file system access to obtain encrypted Perforce passwords and decrypt them.",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jvnet.hudson.plugins:perforce"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.3.36"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000145"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/perforce-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2018-03-26/#SECURITY-373"
@@ -31,8 +54,8 @@
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:43:17Z",
"nvd_published_at": "2018-04-05T13:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-h7rx-r733-7x7r/GHSA-h7rx-r733-7x7r.json → advisories/github-reviewed/2022/05/GHSA-h7rx-r733-7x7r/GHSA-h7rx-r733-7x7r.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h7rx-r733-7x7r",
"modified": "2022-05-13T01:40:57Z",
"modified": "2024-01-30T22:44:02Z",
"published": "2022-05-13T01:40:57Z",
"aliases": [
"CVE-2017-1000107"
],
"summary": "Sandbox bypass in Jenkins Script Security Plugin sandbox bypass",
"details": "Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:script-security"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.31"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 1.30"
}
}
],
"references": [
{
@@ -31,8 +53,8 @@
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:44:02Z",
"nvd_published_at": "2017-10-05T01:29:00Z"
}
}