diff --git a/advisories/github-reviewed/2022/12/GHSA-8w3p-qh3x-6gjr/GHSA-8w3p-qh3x-6gjr.json b/advisories/github-reviewed/2022/12/GHSA-8w3p-qh3x-6gjr/GHSA-8w3p-qh3x-6gjr.json index 17c3524f405..13267f616e3 100644 --- a/advisories/github-reviewed/2022/12/GHSA-8w3p-qh3x-6gjr/GHSA-8w3p-qh3x-6gjr.json +++ b/advisories/github-reviewed/2022/12/GHSA-8w3p-qh3x-6gjr/GHSA-8w3p-qh3x-6gjr.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-8w3p-qh3x-6gjr", - "modified": "2022-12-13T17:13:37Z", + "modified": "2024-10-29T14:59:57Z", "published": "2022-12-13T17:13:37Z", "aliases": [ "CVE-2022-23504" ], "summary": "TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration", - "details": "### Problem\nDue to the lack of handling user-submitted [YAML placeholder expressions](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Configuration/Yaml/YamlApi.html#custom-placeholder-processing) in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors.\n\nA valid backend user account having administrator privileges is needed to exploit this vulnerability.\n\n### Solution\nUpdate to TYPO3 versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.\n\n### References\n* [TYPO3-CORE-SA-2022-016](https://typo3.org/security/advisory/typo3-core-sa-2022-016)\n", + "details": "> ### CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C` (5.3)\n\n### Problem\nDue to the lack of handling user-submitted [YAML placeholder expressions](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Configuration/Yaml/YamlApi.html#custom-placeholder-processing) in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors.\n\nA valid backend user account having administrator privileges is needed to exploit this vulnerability.\n\n### Solution\nUpdate to TYPO3 versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.\n\n### Credits\nThanks to TYPO3 core & security team member Oliver Hader who reported and fixed the issue.\n\n### References\n* [TYPO3-CORE-SA-2022-016](https://typo3.org/security/advisory/typo3-core-sa-2022-016)\n", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/10/GHSA-2rxp-v6pw-ch6m/GHSA-2rxp-v6pw-ch6m.json b/advisories/github-reviewed/2024/10/GHSA-2rxp-v6pw-ch6m/GHSA-2rxp-v6pw-ch6m.json index 036cd55155a..81abdc6b4c2 100644 --- a/advisories/github-reviewed/2024/10/GHSA-2rxp-v6pw-ch6m/GHSA-2rxp-v6pw-ch6m.json +++ b/advisories/github-reviewed/2024/10/GHSA-2rxp-v6pw-ch6m/GHSA-2rxp-v6pw-ch6m.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-2rxp-v6pw-ch6m", - "modified": "2024-10-28T17:59:46Z", + "modified": "2024-10-29T14:59:27Z", "published": "2024-10-28T14:10:18Z", "aliases": [ "CVE-2024-49761" @@ -56,6 +56,10 @@ "type": "PACKAGE", "url": "https://github.com/ruby/rexml" }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-49761.yml" + }, { "type": "WEB", "url": "https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761" diff --git a/advisories/github-reviewed/2024/10/GHSA-j945-c44v-97g6/GHSA-j945-c44v-97g6.json b/advisories/github-reviewed/2024/10/GHSA-j945-c44v-97g6/GHSA-j945-c44v-97g6.json index 1ad63de42d5..fc8933e3951 100644 --- a/advisories/github-reviewed/2024/10/GHSA-j945-c44v-97g6/GHSA-j945-c44v-97g6.json +++ b/advisories/github-reviewed/2024/10/GHSA-j945-c44v-97g6/GHSA-j945-c44v-97g6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j945-c44v-97g6", - "modified": "2024-10-28T19:44:10Z", + "modified": "2024-10-29T14:59:41Z", "published": "2024-10-28T18:30:32Z", "aliases": [ "CVE-2024-49771" @@ -169,6 +169,10 @@ { "type": "PACKAGE", "url": "https://github.com/joniles/mpxj" + }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mpxj/CVE-2024-49771.yml" } ], "database_specific": {