netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-268v-2qq7-84pf
GHSA-5293-3fgp-cr3x
GHSA-fhgg-j92h-29rc
GHSA-268v-2qq7-84pf
This commit is contained in:
advisory-database[bot]
2024-01-30 22:00:39 +00:00
parent b865502c57
commit ff943695bb
4 changed files with 114 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-268v-2qq7-84pf/GHSA-268v-2qq7-84pf.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-268v-2qq7-84pf",
"modified": "2024-01-30T21:58:23Z",
"published": "2022-05-13T01:18:20Z",
"aliases": [
"CVE-2017-1000243"
],
"summary": "Missing permission check in Jenkins Favorite Plugin",
"details": "Jenkins Favorite Plugin up to and including 2.1.0 does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jvnet.hudson.plugins:favorite"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000243"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/favorite-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2017-06-06/"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101946"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:58:23Z",
"nvd_published_at": "2017-11-01T13:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-5293-3fgp-cr3x/GHSA-5293-3fgp-cr3x.json → advisories/github-reviewed/2022/05/GHSA-5293-3fgp-cr3x/GHSA-5293-3fgp-cr3x.json
+26 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5293-3fgp-cr3x",
"modified": "2022-05-13T01:18:19Z",
"modified": "2024-01-30T21:58:47Z",
"published": "2022-05-13T01:18:19Z",
"aliases": [
"CVE-2017-1000086"
],
"summary": "Missing permission checks in Jenkins Periodic Backup Plugin allow every user to change settings",
"details": "The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:periodicbackup"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 1.4"
}
}
],
"references": [
{
@@ -35,8 +57,8 @@
"CWE-862"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:58:47Z",
"nvd_published_at": "2017-10-05T01:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-fhgg-j92h-29rc/GHSA-fhgg-j92h-29rc.json → advisories/github-reviewed/2022/05/GHSA-fhgg-j92h-29rc/GHSA-fhgg-j92h-29rc.json
+23 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fhgg-j92h-29rc",
"modified": "2022-05-13T01:25:16Z",
"modified": "2024-01-30T21:59:05Z",
"published": "2022-05-13T01:25:16Z",
"aliases": [
"CVE-2019-1003091"
],
"summary": "Missing permission check in Jenkins SOASTA CloudTest Plugin",
"details": "A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.soasta.jenkins:cloudtest"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.25"
}
]
}
]
}
],
"references": [
{
@@ -39,8 +58,8 @@
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:59:05Z",
"nvd_published_at": "2019-04-04T16:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-268v-2qq7-84pf/GHSA-268v-2qq7-84pf.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-268v-2qq7-84pf",
"modified": "2022-05-13T01:18:20Z",
"published": "2022-05-13T01:18:20Z",
"aliases": [
"CVE-2017-1000243"
],
"details": "Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000243"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2017-06-06/"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101946"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-01T13:29:00Z"
}
}