diff --git a/advisories/unreviewed/2022/05/GHSA-5532-prrf-rf5x/GHSA-5532-prrf-rf5x.json b/advisories/github-reviewed/2022/05/GHSA-5532-prrf-rf5x/GHSA-5532-prrf-rf5x.json similarity index 60% rename from advisories/unreviewed/2022/05/GHSA-5532-prrf-rf5x/GHSA-5532-prrf-rf5x.json rename to advisories/github-reviewed/2022/05/GHSA-5532-prrf-rf5x/GHSA-5532-prrf-rf5x.json index ed082a44804..f4843069910 100644 --- a/advisories/unreviewed/2022/05/GHSA-5532-prrf-rf5x/GHSA-5532-prrf-rf5x.json +++ b/advisories/github-reviewed/2022/05/GHSA-5532-prrf-rf5x/GHSA-5532-prrf-rf5x.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-5532-prrf-rf5x", - "modified": "2022-05-13T01:41:14Z", + "modified": "2024-01-30T22:43:47Z", "published": "2022-05-13T01:41:14Z", "aliases": [ "CVE-2017-1000403" ], + "summary": "Arbitrary code execution vulnerability in Jenkins Speaks! Plugin", "details": "Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM, effectively elevating privileges to Overall/Run Scripts.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jvnet.hudson.plugins:speaks" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.1.1" + } + ] + } + ] + } ], "references": [ { @@ -31,8 +50,8 @@ "CWE-732" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:43:47Z", "nvd_published_at": "2018-01-26T02:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-9rx5-w522-5fh7/GHSA-9rx5-w522-5fh7.json b/advisories/github-reviewed/2022/05/GHSA-9rx5-w522-5fh7/GHSA-9rx5-w522-5fh7.json similarity index 57% rename from advisories/unreviewed/2022/05/GHSA-9rx5-w522-5fh7/GHSA-9rx5-w522-5fh7.json rename to advisories/github-reviewed/2022/05/GHSA-9rx5-w522-5fh7/GHSA-9rx5-w522-5fh7.json index 951c7b3381d..16bb33cd68b 100644 --- a/advisories/unreviewed/2022/05/GHSA-9rx5-w522-5fh7/GHSA-9rx5-w522-5fh7.json +++ b/advisories/github-reviewed/2022/05/GHSA-9rx5-w522-5fh7/GHSA-9rx5-w522-5fh7.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-9rx5-w522-5fh7", - "modified": "2022-05-13T01:48:32Z", + "modified": "2024-01-30T22:43:31Z", "published": "2022-05-13T01:48:32Z", "aliases": [ "CVE-2018-1000114" ], + "summary": "Jenkins Promoted Builds Plugin allowed unauthorized users to run some promotion processes", "details": "An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java that allow an attacker with read access to jobs to perform promotions.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:promoted-builds" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.31.1" + } + } ], "references": [ { @@ -31,8 +53,8 @@ "CWE-863" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:43:31Z", "nvd_published_at": "2018-03-13T13:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-c9px-7j36-f35v/GHSA-c9px-7j36-f35v.json b/advisories/github-reviewed/2022/05/GHSA-c9px-7j36-f35v/GHSA-c9px-7j36-f35v.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-c9px-7j36-f35v/GHSA-c9px-7j36-f35v.json rename to advisories/github-reviewed/2022/05/GHSA-c9px-7j36-f35v/GHSA-c9px-7j36-f35v.json index d0a3188bde5..742b82bdcc5 100644 --- a/advisories/unreviewed/2022/05/GHSA-c9px-7j36-f35v/GHSA-c9px-7j36-f35v.json +++ b/advisories/github-reviewed/2022/05/GHSA-c9px-7j36-f35v/GHSA-c9px-7j36-f35v.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-c9px-7j36-f35v", - "modified": "2022-05-13T01:48:34Z", + "modified": "2024-01-30T22:42:51Z", "published": "2022-05-13T01:48:34Z", "aliases": [ "CVE-2018-1000189" ], + "summary": "CSRF vulnerability and missing permission checks in Jenkins AbsInt Astrée Plugin", "details": "A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with Overall/Read access to execute a command on the Jenkins master.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:absint-astree" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.7" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.0.5" + } + } ], "references": [ { @@ -31,8 +53,8 @@ ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:42:51Z", "nvd_published_at": "2018-06-05T20:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-crvq-mw2w-4cfx/GHSA-crvq-mw2w-4cfx.json b/advisories/github-reviewed/2022/05/GHSA-crvq-mw2w-4cfx/GHSA-crvq-mw2w-4cfx.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-crvq-mw2w-4cfx/GHSA-crvq-mw2w-4cfx.json rename to advisories/github-reviewed/2022/05/GHSA-crvq-mw2w-4cfx/GHSA-crvq-mw2w-4cfx.json index 5ff69b12056..feb3f8b4cf5 100644 --- a/advisories/unreviewed/2022/05/GHSA-crvq-mw2w-4cfx/GHSA-crvq-mw2w-4cfx.json +++ b/advisories/github-reviewed/2022/05/GHSA-crvq-mw2w-4cfx/GHSA-crvq-mw2w-4cfx.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-crvq-mw2w-4cfx", - "modified": "2022-05-13T01:48:34Z", + "modified": "2024-01-30T22:42:35Z", "published": "2022-05-13T01:48:34Z", "aliases": [ "CVE-2018-1000197" ], + "summary": "Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration", "details": "An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/Read permission to read and write the Black Duck Hub plugin configuration.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "com.blackducksoftware.integration:blackduck-hub" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.1.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.0.3" + } + } ], "references": [ { @@ -31,8 +53,8 @@ "CWE-863" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:42:35Z", "nvd_published_at": "2018-06-05T21:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-cwxx-gwwj-pqjq/GHSA-cwxx-gwwj-pqjq.json b/advisories/github-reviewed/2022/05/GHSA-cwxx-gwwj-pqjq/GHSA-cwxx-gwwj-pqjq.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-cwxx-gwwj-pqjq/GHSA-cwxx-gwwj-pqjq.json rename to advisories/github-reviewed/2022/05/GHSA-cwxx-gwwj-pqjq/GHSA-cwxx-gwwj-pqjq.json index 47610f5fe04..5bdaec9bac2 100644 --- a/advisories/unreviewed/2022/05/GHSA-cwxx-gwwj-pqjq/GHSA-cwxx-gwwj-pqjq.json +++ b/advisories/github-reviewed/2022/05/GHSA-cwxx-gwwj-pqjq/GHSA-cwxx-gwwj-pqjq.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-cwxx-gwwj-pqjq", - "modified": "2022-05-13T01:48:33Z", + "modified": "2024-01-30T22:43:17Z", "published": "2022-05-13T01:48:33Z", "aliases": [ "CVE-2018-1000145" ], + "summary": "Jenkins Perforce Plugin uses ineffective credentials encryption", "details": "An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with local file system access to obtain encrypted Perforce passwords and decrypt them.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jvnet.hudson.plugins:perforce" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.3.36" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000145" }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/perforce-plugin" + }, { "type": "WEB", "url": "https://jenkins.io/security/advisory/2018-03-26/#SECURITY-373" @@ -31,8 +54,8 @@ "CWE-200" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:43:17Z", "nvd_published_at": "2018-04-05T13:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-h7rx-r733-7x7r/GHSA-h7rx-r733-7x7r.json b/advisories/github-reviewed/2022/05/GHSA-h7rx-r733-7x7r/GHSA-h7rx-r733-7x7r.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-h7rx-r733-7x7r/GHSA-h7rx-r733-7x7r.json rename to advisories/github-reviewed/2022/05/GHSA-h7rx-r733-7x7r/GHSA-h7rx-r733-7x7r.json index f4bd727d926..6648d7036f3 100644 --- a/advisories/unreviewed/2022/05/GHSA-h7rx-r733-7x7r/GHSA-h7rx-r733-7x7r.json +++ b/advisories/github-reviewed/2022/05/GHSA-h7rx-r733-7x7r/GHSA-h7rx-r733-7x7r.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-h7rx-r733-7x7r", - "modified": "2022-05-13T01:40:57Z", + "modified": "2024-01-30T22:44:02Z", "published": "2022-05-13T01:40:57Z", "aliases": [ "CVE-2017-1000107" ], + "summary": "Sandbox bypass in Jenkins Script Security Plugin sandbox bypass", "details": "Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:script-security" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.31" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.30" + } + } ], "references": [ { @@ -31,8 +53,8 @@ ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:44:02Z", "nvd_published_at": "2017-10-05T01:29:00Z" } } \ No newline at end of file