Publish Advisories

GHSA-7cgp-c3g7-qvrw
GHSA-9hx9-w2j6-rw76
GHSA-gj4p-3wh3-2rmf

advisories/github-reviewed/2017/10/GHSA-7cgp-c3g7-qvrw/GHSA-7cgp-c3g7-qvrw.json

@@ -37,6 +37,18 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0082"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0082.yml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://groups.google.com/forum/message/raw?msg=rubyonrails-security/LMxO_3_eCuc/ozGBEhKaJbIJ"
+    },
+    {
+      "type": "WEB",
+      "url": "https://puppet.com/security/cve/cve-2014-0082"
+    },
     {
       "type": "WEB",
       "url": "https://web.archive.org/web/20201207044540/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/LMxO_3_eCuc/ozGBEhKaJbIJ"
@@ -61,6 +73,14 @@
       "type": "WEB",
       "url": "http://rhn.redhat.com/errata/RHSA-2014-0306.html"
     },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/57376"
+    },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/57836"
+    },
     {
       "type": "WEB",
       "url": "http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/"

advisories/github-reviewed/2017/10/GHSA-9hx9-w2j6-rw76/GHSA-9hx9-w2j6-rw76.json

@@ -1,12 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9hx9-w2j6-rw76",
-  "modified": "2020-06-16T21:28:50Z",
+  "modified": "2023-06-09T20:10:31Z",
   "published": "2017-10-24T18:33:37Z",
   "aliases": [
     "CVE-2013-2105"
   ],
-  "summary": "Low severity vulnerability that affects show_in_browser",
+  "summary": "Script Injection in show_in_browser",
   "details": "The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.",
   "severity": [
 
@@ -35,6 +35,10 @@
       "type": "ADVISORY",
       "url": "https://github.com/advisories/GHSA-9hx9-w2j6-rw76"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/show_in_browser/CVE-2013-2105.yml"
+    },
     {
       "type": "WEB",
       "url": "http://vapid.dhs.org/advisories/show_in_browser.html"
@@ -48,7 +52,7 @@
     "cwe_ids": [
       "CWE-59"
     ],
-    "severity": "LOW",
+    "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2020-06-16T21:28:50Z",
     "nvd_published_at": null

advisories/github-reviewed/2017/12/GHSA-gj4p-3wh3-2rmf/GHSA-gj4p-3wh3-2rmf.json

@@ -1,12 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-gj4p-3wh3-2rmf",
-  "modified": "2021-09-10T21:52:34Z",
+  "modified": "2023-06-09T20:11:56Z",
   "published": "2017-12-21T00:47:25Z",
   "aliases": [
     "CVE-2017-17042"
   ],
-  "summary": "High severity vulnerability that affects yard",
+  "summary": "Arbitrary file read vulnerability in yard server",
   "details": "lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.",
   "severity": [
     {
@@ -51,6 +51,10 @@
     {
       "type": "PACKAGE",
       "url": "https://github.com/lsegal/yard"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2017-17042.yml"
     }
   ],
   "database_specific": {