From 010d2236317e4f38e788393d6efcf02628c2f6de Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 24 Apr 2024 20:47:46 +0000 Subject: [PATCH] Publish Advisories GHSA-24q2-6x37-cgcx GHSA-2gc5-3h3p-8vpf GHSA-3v8x-286h-9pxp GHSA-4xfw-599q-fmp6 GHSA-78hj-952q-99rw GHSA-97jv-2hp6-3frj --- .../GHSA-24q2-6x37-cgcx.json | 34 ++++++++++++++++--- .../GHSA-2gc5-3h3p-8vpf.json | 31 ++++++++++++++--- .../GHSA-3v8x-286h-9pxp.json | 31 ++++++++++++++--- .../GHSA-4xfw-599q-fmp6.json | 31 ++++++++++++++--- .../GHSA-78hj-952q-99rw.json | 31 ++++++++++++++--- .../GHSA-97jv-2hp6-3frj.json | 31 ++++++++++++++--- 6 files changed, 165 insertions(+), 24 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-24q2-6x37-cgcx/GHSA-24q2-6x37-cgcx.json (56%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-2gc5-3h3p-8vpf/GHSA-2gc5-3h3p-8vpf.json (58%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-3v8x-286h-9pxp/GHSA-3v8x-286h-9pxp.json (62%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-4xfw-599q-fmp6/GHSA-4xfw-599q-fmp6.json (59%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-78hj-952q-99rw/GHSA-78hj-952q-99rw.json (58%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-97jv-2hp6-3frj/GHSA-97jv-2hp6-3frj.json (61%) diff --git a/advisories/unreviewed/2022/05/GHSA-24q2-6x37-cgcx/GHSA-24q2-6x37-cgcx.json b/advisories/github-reviewed/2022/05/GHSA-24q2-6x37-cgcx/GHSA-24q2-6x37-cgcx.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-24q2-6x37-cgcx/GHSA-24q2-6x37-cgcx.json rename to advisories/github-reviewed/2022/05/GHSA-24q2-6x37-cgcx/GHSA-24q2-6x37-cgcx.json index 10708772e55..20a7a5b7cc5 100644 --- a/advisories/unreviewed/2022/05/GHSA-24q2-6x37-cgcx/GHSA-24q2-6x37-cgcx.json +++ b/advisories/github-reviewed/2022/05/GHSA-24q2-6x37-cgcx/GHSA-24q2-6x37-cgcx.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-24q2-6x37-cgcx", - "modified": "2022-05-14T03:00:59Z", + "modified": "2024-04-24T20:45:26Z", "published": "2022-05-14T03:00:59Z", "aliases": [ "CVE-2018-13450" ], + "summary": "Dolibarr SQL injection vulnerability in product/card.php", "details": "SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the status_batch parameter.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.3" + }, + { + "fixed": "7.0.4" + } + ] + } + ], + "versions": [ + "7.0.3" + ] + } ], "references": [ { @@ -24,6 +46,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/36402c22eef49d60edd73a2f312f8e28fe0bd1cb" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +57,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:45:26Z", "nvd_published_at": "2018-07-08T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-2gc5-3h3p-8vpf/GHSA-2gc5-3h3p-8vpf.json b/advisories/github-reviewed/2022/05/GHSA-2gc5-3h3p-8vpf/GHSA-2gc5-3h3p-8vpf.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-2gc5-3h3p-8vpf/GHSA-2gc5-3h3p-8vpf.json rename to advisories/github-reviewed/2022/05/GHSA-2gc5-3h3p-8vpf/GHSA-2gc5-3h3p-8vpf.json index 1403cc5332b..2177cc28d0a 100644 --- a/advisories/unreviewed/2022/05/GHSA-2gc5-3h3p-8vpf/GHSA-2gc5-3h3p-8vpf.json +++ b/advisories/github-reviewed/2022/05/GHSA-2gc5-3h3p-8vpf/GHSA-2gc5-3h3p-8vpf.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-2gc5-3h3p-8vpf", - "modified": "2022-05-14T01:42:49Z", + "modified": "2024-04-24T20:45:50Z", "published": "2022-05-14T01:42:49Z", "aliases": [ "CVE-2018-19993" ], + "summary": "Dolibarr reflected cross-site scripting (XSS) vulnerability", "details": "A reflected cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the transphrase parameter to public/notice.php.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.4" + } + ] + } + ] + } ], "references": [ { @@ -24,6 +43,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/fc3fcc5455d9a610b85723e89e8be43a41ad1378" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +54,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:45:50Z", "nvd_published_at": "2019-01-03T19:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-3v8x-286h-9pxp/GHSA-3v8x-286h-9pxp.json b/advisories/github-reviewed/2022/05/GHSA-3v8x-286h-9pxp/GHSA-3v8x-286h-9pxp.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-3v8x-286h-9pxp/GHSA-3v8x-286h-9pxp.json rename to advisories/github-reviewed/2022/05/GHSA-3v8x-286h-9pxp/GHSA-3v8x-286h-9pxp.json index 087e4e15dff..abbc12aeac9 100644 --- a/advisories/unreviewed/2022/05/GHSA-3v8x-286h-9pxp/GHSA-3v8x-286h-9pxp.json +++ b/advisories/github-reviewed/2022/05/GHSA-3v8x-286h-9pxp/GHSA-3v8x-286h-9pxp.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-3v8x-286h-9pxp", - "modified": "2022-05-14T01:42:50Z", + "modified": "2024-04-24T20:45:40Z", "published": "2022-05-14T01:42:50Z", "aliases": [ "CVE-2018-19995" ], + "summary": "Dolibarr stored cross-site scripting (XSS) vulnerability", "details": "A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the \"address\" (POST) or \"town\" (POST) parameter to user/card.php.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.4" + } + ] + } + ] + } ], "references": [ { @@ -28,6 +47,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/bacd5110fbdc81a35030fdc322775fa15ea85924" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -35,8 +58,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:45:40Z", "nvd_published_at": "2019-01-03T19:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-4xfw-599q-fmp6/GHSA-4xfw-599q-fmp6.json b/advisories/github-reviewed/2022/05/GHSA-4xfw-599q-fmp6/GHSA-4xfw-599q-fmp6.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-4xfw-599q-fmp6/GHSA-4xfw-599q-fmp6.json rename to advisories/github-reviewed/2022/05/GHSA-4xfw-599q-fmp6/GHSA-4xfw-599q-fmp6.json index 82a09a042ac..a220f95ae20 100644 --- a/advisories/unreviewed/2022/05/GHSA-4xfw-599q-fmp6/GHSA-4xfw-599q-fmp6.json +++ b/advisories/github-reviewed/2022/05/GHSA-4xfw-599q-fmp6/GHSA-4xfw-599q-fmp6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-4xfw-599q-fmp6", - "modified": "2022-05-14T01:42:49Z", + "modified": "2024-04-24T20:46:51Z", "published": "2022-05-14T01:42:49Z", "aliases": [ "CVE-2018-19992" ], + "summary": "Dolibarr stored cross-site scripting (XSS) vulnerability", "details": "A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the \"address\" (POST) or \"town\" (POST) parameter to adherents/type.php.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.4" + } + ] + } + ] + } ], "references": [ { @@ -24,6 +43,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/0f06e39d23636bd1e4039ac61a743c79725c798b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +54,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:46:51Z", "nvd_published_at": "2019-01-03T19:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-78hj-952q-99rw/GHSA-78hj-952q-99rw.json b/advisories/github-reviewed/2022/05/GHSA-78hj-952q-99rw/GHSA-78hj-952q-99rw.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-78hj-952q-99rw/GHSA-78hj-952q-99rw.json rename to advisories/github-reviewed/2022/05/GHSA-78hj-952q-99rw/GHSA-78hj-952q-99rw.json index 7b6f6cac02f..d7865fe670c 100644 --- a/advisories/unreviewed/2022/05/GHSA-78hj-952q-99rw/GHSA-78hj-952q-99rw.json +++ b/advisories/github-reviewed/2022/05/GHSA-78hj-952q-99rw/GHSA-78hj-952q-99rw.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-78hj-952q-99rw", - "modified": "2022-05-14T01:42:07Z", + "modified": "2024-04-24T20:47:02Z", "published": "2022-05-14T01:42:07Z", "aliases": [ "CVE-2018-19994" ], + "summary": "Dolibarr error-based SQL injection vulnerability in product/card.php", "details": "An error-based SQL injection vulnerability in product/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the desiredstock parameter.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.4" + } + ] + } + ] + } ], "references": [ { @@ -24,6 +43,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/850b939ffd2c7a4443649331b923d5e0da2d6446" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +54,8 @@ "CWE-89" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:47:02Z", "nvd_published_at": "2019-01-03T19:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-97jv-2hp6-3frj/GHSA-97jv-2hp6-3frj.json b/advisories/github-reviewed/2022/05/GHSA-97jv-2hp6-3frj/GHSA-97jv-2hp6-3frj.json similarity index 61% rename from advisories/unreviewed/2022/05/GHSA-97jv-2hp6-3frj/GHSA-97jv-2hp6-3frj.json rename to advisories/github-reviewed/2022/05/GHSA-97jv-2hp6-3frj/GHSA-97jv-2hp6-3frj.json index 91c8083773f..7d4b556e766 100644 --- a/advisories/unreviewed/2022/05/GHSA-97jv-2hp6-3frj/GHSA-97jv-2hp6-3frj.json +++ b/advisories/github-reviewed/2022/05/GHSA-97jv-2hp6-3frj/GHSA-97jv-2hp6-3frj.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-97jv-2hp6-3frj", - "modified": "2022-05-14T01:41:36Z", + "modified": "2024-04-24T20:47:17Z", "published": "2022-05-14T01:41:36Z", "aliases": [ "CVE-2018-19998" ], + "summary": "Dolibarr SQL injection vulnerability in user/card.php", "details": "SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the employee parameter.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.4" + } + ] + } + ] + } ], "references": [ { @@ -28,6 +47,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/bacd5110fbdc81a35030fdc322775fa15ea85924" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -35,8 +58,8 @@ "CWE-89" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:47:17Z", "nvd_published_at": "2019-01-03T19:29:00Z" } } \ No newline at end of file