Publish Advisories

GHSA-34w4-wrqp-j47g
GHSA-4gpm-r23h-gprw

advisories/github-reviewed/2023/10/GHSA-34w4-wrqp-j47g/GHSA-34w4-wrqp-j47g.json

@@ -47,6 +47,10 @@
     {
       "type": "PACKAGE",
       "url": "https://github.com/thorsten/phpMyFAQ"
+    },
+    {
+      "type": "WEB",
+      "url": "https://huntr.com/bounties/ec44bcba-ae7f-497a-851e-8165ecf56945"
     }
   ],
   "database_specific": {
@@ -56,6 +60,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2023-10-31T19:39:42Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2023-10-31T01:15:07Z"
   }
 }

advisories/github-reviewed/2023/10/GHSA-4gpm-r23h-gprw/GHSA-4gpm-r23h-gprw.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4gpm-r23h-gprw",
-  "modified": "2023-10-31T19:30:57Z",
+  "modified": "2023-11-08T18:41:14Z",
   "published": "2023-10-31T03:31:22Z",
   "aliases": [
     "CVE-2015-20110"
@@ -9,7 +9,10 @@
   "summary": "generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character",
   "details": "JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
   ],
   "affected": [
     {
@@ -60,11 +63,12 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-208"
+      "CWE-208",
+      "CWE-307"
     ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2023-10-31T19:30:57Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2023-10-31T03:15:07Z"
   }
 }