From 0de9224a44f21f718af4128a1edd8da57e4c449d Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 29 Jan 2024 16:26:29 +0000
Subject: [PATCH] Publish Advisories

GHSA-297x-2qf3-jrj3
GHSA-chj7-w3f6-cvfj
GHSA-fh38-9fgr-454w
---
 .../01/GHSA-297x-2qf3-jrj3/GHSA-297x-2qf3-jrj3.json   | 11 +++++++----
 .../01/GHSA-chj7-w3f6-cvfj/GHSA-chj7-w3f6-cvfj.json   |  6 +++++-
 .../01/GHSA-fh38-9fgr-454w/GHSA-fh38-9fgr-454w.json   |  7 +++++--
 3 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/advisories/github-reviewed/2024/01/GHSA-297x-2qf3-jrj3/GHSA-297x-2qf3-jrj3.json b/advisories/github-reviewed/2024/01/GHSA-297x-2qf3-jrj3/GHSA-297x-2qf3-jrj3.json
index 87423c8a9c8..180f26f3dca 100644
--- a/advisories/github-reviewed/2024/01/GHSA-297x-2qf3-jrj3/GHSA-297x-2qf3-jrj3.json
+++ b/advisories/github-reviewed/2024/01/GHSA-297x-2qf3-jrj3/GHSA-297x-2qf3-jrj3.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-297x-2qf3-jrj3",
-  "modified": "2024-01-29T03:14:52Z",
+  "modified": "2024-01-29T16:25:51Z",
   "published": "2024-01-21T18:30:34Z",
   "aliases": [
     "CVE-2024-23730"
@@ -9,7 +9,10 @@
   "summary": "Unsafe yaml deserialization in llama-hub",
   "details": "The OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67 allow attackers to execute arbitrary code because safe_load is not used for YAML.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
     {
@@ -39,7 +42,7 @@
     },
     {
       "type": "WEB",
-      "url": "https://github.com/run-llama/llama-hub/pull/841/commits/9dc9c21a5c6d0226d1d2101c3121d4f085743d52"
+      "url": "https://github.com/run-llama/llama-hub/commit/c01416e737c7747a213a79881b8308c41d043515"
     },
     {
       "type": "PACKAGE",
@@ -58,7 +61,7 @@
     "cwe_ids": [
       "CWE-502"
     ],
-    "severity": "HIGH",
+    "severity": "CRITICAL",
     "github_reviewed": true,
     "github_reviewed_at": "2024-01-22T21:23:34Z",
     "nvd_published_at": "2024-01-21T17:15:44Z"
diff --git a/advisories/github-reviewed/2024/01/GHSA-chj7-w3f6-cvfj/GHSA-chj7-w3f6-cvfj.json b/advisories/github-reviewed/2024/01/GHSA-chj7-w3f6-cvfj/GHSA-chj7-w3f6-cvfj.json
index 3b4584774e2..962f40c8c51 100644
--- a/advisories/github-reviewed/2024/01/GHSA-chj7-w3f6-cvfj/GHSA-chj7-w3f6-cvfj.json
+++ b/advisories/github-reviewed/2024/01/GHSA-chj7-w3f6-cvfj/GHSA-chj7-w3f6-cvfj.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-chj7-w3f6-cvfj",
-  "modified": "2024-01-23T14:41:50Z",
+  "modified": "2024-01-29T16:25:04Z",
   "published": "2024-01-20T21:30:25Z",
   "aliases": [
     "CVE-2024-0521"
@@ -40,6 +40,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0521"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/PaddlePaddle/Paddle"
+    },
     {
       "type": "WEB",
       "url": "https://huntr.com/bounties/a569c64b-1e2b-4bed-a19f-47fd5a3da453"
diff --git a/advisories/github-reviewed/2024/01/GHSA-fh38-9fgr-454w/GHSA-fh38-9fgr-454w.json b/advisories/github-reviewed/2024/01/GHSA-fh38-9fgr-454w/GHSA-fh38-9fgr-454w.json
index 9d0296d7c38..c8294ea579f 100644
--- a/advisories/github-reviewed/2024/01/GHSA-fh38-9fgr-454w/GHSA-fh38-9fgr-454w.json
+++ b/advisories/github-reviewed/2024/01/GHSA-fh38-9fgr-454w/GHSA-fh38-9fgr-454w.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-fh38-9fgr-454w",
-  "modified": "2024-01-22T21:32:16Z",
+  "modified": "2024-01-29T16:25:12Z",
   "published": "2024-01-21T06:30:22Z",
   "aliases": [
     "CVE-2024-23725"
@@ -9,7 +9,10 @@
   "summary": "Cross-site Scripting in Ghost",
   "details": "Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
   ],
   "affected": [
     {