diff --git a/advisories/github-reviewed/2023/10/GHSA-34w4-wrqp-j47g/GHSA-34w4-wrqp-j47g.json b/advisories/github-reviewed/2023/10/GHSA-34w4-wrqp-j47g/GHSA-34w4-wrqp-j47g.json index a94f0945ff5..34ddaa48dd6 100644 --- a/advisories/github-reviewed/2023/10/GHSA-34w4-wrqp-j47g/GHSA-34w4-wrqp-j47g.json +++ b/advisories/github-reviewed/2023/10/GHSA-34w4-wrqp-j47g/GHSA-34w4-wrqp-j47g.json @@ -47,6 +47,10 @@ { "type": "PACKAGE", "url": "https://github.com/thorsten/phpMyFAQ" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/ec44bcba-ae7f-497a-851e-8165ecf56945" } ], "database_specific": { @@ -56,6 +60,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-10-31T19:39:42Z", - "nvd_published_at": null + "nvd_published_at": "2023-10-31T01:15:07Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/10/GHSA-4gpm-r23h-gprw/GHSA-4gpm-r23h-gprw.json b/advisories/github-reviewed/2023/10/GHSA-4gpm-r23h-gprw/GHSA-4gpm-r23h-gprw.json index 277e2958e0e..133be1ce12e 100644 --- a/advisories/github-reviewed/2023/10/GHSA-4gpm-r23h-gprw/GHSA-4gpm-r23h-gprw.json +++ b/advisories/github-reviewed/2023/10/GHSA-4gpm-r23h-gprw/GHSA-4gpm-r23h-gprw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4gpm-r23h-gprw", - "modified": "2023-10-31T19:30:57Z", + "modified": "2023-11-08T18:41:14Z", "published": "2023-10-31T03:31:22Z", "aliases": [ "CVE-2015-20110" @@ -9,7 +9,10 @@ "summary": "generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character", "details": "JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ { @@ -60,11 +63,12 @@ ], "database_specific": { "cwe_ids": [ - "CWE-208" + "CWE-208", + "CWE-307" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-10-31T19:30:57Z", - "nvd_published_at": null + "nvd_published_at": "2023-10-31T03:15:07Z" } } \ No newline at end of file