Skip to content

Commit 53df4b5

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-h83r-7f9f-mqjj GHSA-jfg6-4gx3-3v7w GHSA-jwm4-955w-4hj3 GHSA-mj6v-4wr4-gj57 GHSA-x2pv-fph3-phfx GHSA-h83r-7f9f-mqjj GHSA-jfg6-4gx3-3v7w GHSA-jwm4-955w-4hj3 GHSA-mj6v-4wr4-gj57 GHSA-x2pv-fph3-phfx
1 parent 2215cfc commit 53df4b5

File tree

10 files changed

+297
-180
lines changed

10 files changed

+297
-180
lines changed

‎advisories/github-reviewed/2025/10/GHSA-h83r-7f9f-mqjj/GHSA-h83r-7f9f-mqjj.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h83r-7f9f-mqjj",
4+
"modified": "2025-10-29T22:05:42Z",
5+
"published": "2025-10-29T15:31:56Z",
6+
"aliases": [
7+
"CVE-2025-64142"
8+
],
9+
"summary": "Jenkins Nexus Task Runner Plugin is missing a permission check",
10+
"details": "Jenkins Nexus Task Runner Plugin 0.9.2 and earlier does not perform a permission check in an HTTP endpoint.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.\n\nAdditionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nAs of publication of this advisory, there is no fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.plugins:nexus-task-runner"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.9.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64142"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3550"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-862"
51+
],
52+
"severity": "MODERATE",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2025-10-29T22:05:42Z",
55+
"nvd_published_at": "2025-10-29T14:15:58Z"
56+
}
57+
}

‎advisories/github-reviewed/2025/10/GHSA-jfg6-4gx3-3v7w/GHSA-jfg6-4gx3-3v7w.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jfg6-4gx3-3v7w",
4+
"modified": "2025-10-29T22:04:08Z",
5+
"published": "2025-10-29T15:31:56Z",
6+
"aliases": [
7+
"CVE-2025-64134"
8+
],
9+
"summary": "Jenkins JDepend Plugin vulnerable to XML external entity attacks",
10+
"details": "Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers able to configure input files for the \"Report JDepend\" step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.\n\nAs of publication of this advisory, there is no fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.plugins:jdepend"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "1.3.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64134"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/jenkinsci/jdepend-plugin"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-2936"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-611"
55+
],
56+
"severity": "HIGH",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-10-29T22:04:08Z",
59+
"nvd_published_at": "2025-10-29T14:15:57Z"
60+
}
61+
}

‎advisories/github-reviewed/2025/10/GHSA-jwm4-955w-4hj3/GHSA-jwm4-955w-4hj3.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jwm4-955w-4hj3",
4+
"modified": "2025-10-29T22:05:03Z",
5+
"published": "2025-10-29T15:31:56Z",
6+
"aliases": [
7+
"CVE-2025-64137"
8+
],
9+
"summary": "Jenkins Themis Plugin is missing a permission check",
10+
"details": "Jenkins Themis Plugin 1.4.1 and earlier does not perform a permission check in an HTTP endpoint.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL.\n\nAdditionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nAs of publication of this advisory, there is no fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.plugins:themis"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "1.4.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64137"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/jenkinsci/themis-plugin"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3517"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-862"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-10-29T22:05:03Z",
59+
"nvd_published_at": "2025-10-29T14:15:58Z"
60+
}
61+
}

‎advisories/github-reviewed/2025/10/GHSA-mj6v-4wr4-gj57/GHSA-mj6v-4wr4-gj57.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mj6v-4wr4-gj57",
4+
"modified": "2025-10-29T22:04:34Z",
5+
"published": "2025-10-29T15:31:56Z",
6+
"aliases": [
7+
"CVE-2025-64139"
8+
],
9+
"summary": "Jenkins Start Windocks Containers Plugin is missing a permission check",
10+
"details": "Jenkins Start Windocks Containers Plugin 1.4 and earlier does not perform a permission check in an HTTP endpoint.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL.\n\nAdditionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nAs of publication of this advisory, there is no fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.plugins:windocks-start-container"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "1.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64139"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/jenkinsci/windocks-start-container-plugin"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3531"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-862"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-10-29T22:04:34Z",
59+
"nvd_published_at": "2025-10-29T14:15:58Z"
60+
}
61+
}

‎advisories/github-reviewed/2025/10/GHSA-x2pv-fph3-phfx/GHSA-x2pv-fph3-phfx.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x2pv-fph3-phfx",
4+
"modified": "2025-10-29T22:05:30Z",
5+
"published": "2025-10-29T15:31:56Z",
6+
"aliases": [
7+
"CVE-2025-64141"
8+
],
9+
"summary": "Jenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery",
10+
"details": "Jenkins Nexus Task Runner Plugin 0.9.2 and earlier does not perform a permission check in an HTTP endpoint.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.\n\nAdditionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nAs of publication of this advisory, there is no fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.plugins:nexus-task-runner"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.9.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64141"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3550"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-352"
51+
],
52+
"severity": "MODERATE",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2025-10-29T22:05:30Z",
55+
"nvd_published_at": "2025-10-29T14:15:58Z"
56+
}
57+
}

‎advisories/unreviewed/2025/10/GHSA-h83r-7f9f-mqjj/GHSA-h83r-7f9f-mqjj.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎advisories/unreviewed/2025/10/GHSA-jfg6-4gx3-3v7w/GHSA-jfg6-4gx3-3v7w.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

0 commit comments

Comments
 (0)