From 1201562034c8dce0edfbb112ae4888606e949258 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 23 Jan 2024 16:06:06 +0000
Subject: [PATCH] Publish Advisories

GHSA-7mvr-5x2g-wfc8
GHSA-3wqf-4x89-9g79
---
 .../GHSA-7mvr-5x2g-wfc8.json                  | 67 ++++++++++++++++++-
 .../GHSA-3wqf-4x89-9g79.json                  | 46 ++++++++++++-
 2 files changed, 108 insertions(+), 5 deletions(-)

diff --git a/advisories/github-reviewed/2018/09/GHSA-7mvr-5x2g-wfc8/GHSA-7mvr-5x2g-wfc8.json b/advisories/github-reviewed/2018/09/GHSA-7mvr-5x2g-wfc8/GHSA-7mvr-5x2g-wfc8.json
index f6ce303bf0a..a70a6cb0a90 100644
--- a/advisories/github-reviewed/2018/09/GHSA-7mvr-5x2g-wfc8/GHSA-7mvr-5x2g-wfc8.json
+++ b/advisories/github-reviewed/2018/09/GHSA-7mvr-5x2g-wfc8/GHSA-7mvr-5x2g-wfc8.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7mvr-5x2g-wfc8",
-  "modified": "2023-01-23T20:48:55Z",
+  "modified": "2024-01-23T16:04:48Z",
   "published": "2018-09-13T15:50:32Z",
   "aliases": [
     "CVE-2018-14042"
   ],
   "summary": "Bootstrap Cross-site Scripting vulnerability",
-  "details": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.  This is similar to CVE-2018-14041.",
+  "details": "In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip.  This is similar to CVE-2018-14041.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -25,7 +25,7 @@
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "0"
+              "introduced": "4.0.0"
             },
             {
               "fixed": "4.1.2"
@@ -33,6 +33,63 @@
           ]
         }
       ]
+    },
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "bootstrap"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.3.0"
+            },
+            {
+              "fixed": "3.4.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "bootstrap"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.0.0"
+            },
+            {
+              "fixed": "4.1.2"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "bootstrap"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.3.0"
+            },
+            {
+              "fixed": "3.4.0"
+            }
+          ]
+        }
+      ]
     }
   ],
   "references": [
@@ -56,6 +113,10 @@
       "type": "WEB",
       "url": "https://github.com/twbs/bootstrap/pull/26630"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/twbs/bootstrap/commit/2a5ba23ce8f041f3548317acc992ed8a736b609d"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/twbs/bootstrap/commit/2d90d369bbc2bd2647620246c55cec8c4705e3d0"
diff --git a/advisories/github-reviewed/2022/05/GHSA-3wqf-4x89-9g79/GHSA-3wqf-4x89-9g79.json b/advisories/github-reviewed/2022/05/GHSA-3wqf-4x89-9g79/GHSA-3wqf-4x89-9g79.json
index 386bb96c219..7444c94b958 100644
--- a/advisories/github-reviewed/2022/05/GHSA-3wqf-4x89-9g79/GHSA-3wqf-4x89-9g79.json
+++ b/advisories/github-reviewed/2022/05/GHSA-3wqf-4x89-9g79/GHSA-3wqf-4x89-9g79.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3wqf-4x89-9g79",
-  "modified": "2023-05-22T18:22:16Z",
+  "modified": "2024-01-23T16:05:15Z",
   "published": "2022-05-13T01:07:54Z",
   "aliases": [
     "CVE-2018-14040"
   ],
   "summary": "Bootstrap vulnerable to Cross-Site Scripting (XSS)",
-  "details": "In Bootstrap 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.",
+  "details": "In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -52,6 +52,44 @@
           ]
         }
       ]
+    },
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "bootstrap"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.3.0"
+            },
+            {
+              "fixed": "3.4.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "bootstrap"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.3.0"
+            },
+            {
+              "fixed": "3.4.0"
+            }
+          ]
+        }
+      ]
     }
   ],
   "references": [
@@ -79,6 +117,10 @@
       "type": "WEB",
       "url": "https://github.com/twbs/bootstrap/commit/149096016f70fd815540d62c0989fd99cdc809e0"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/twbs/bootstrap/commit/2a5ba23ce8f041f3548317acc992ed8a736b609d"
+    },
     {
       "type": "WEB",
       "url": "https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/"