Publish Advisories

GHSA-5h86-8mv2-jq9f
GHSA-6p78-f7h9-6838
GHSA-v89q-c273-3p42
GHSA-6845-xw22-ffxv
GHSA-vh73-q3rw-qx7w

advisories/github-reviewed/2024/01/GHSA-5h86-8mv2-jq9f/GHSA-5h86-8mv2-jq9f.json

@@ -60,6 +60,10 @@
       "type": "PACKAGE",
       "url": "https://github.com/aio-libs/aiohttp"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2024-24.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7/"

advisories/github-reviewed/2024/01/GHSA-6p78-f7h9-6838/GHSA-6p78-f7h9-6838.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6p78-f7h9-6838",
-  "modified": "2024-01-30T18:42:48Z",
+  "modified": "2024-02-05T23:06:18Z",
   "published": "2024-01-30T09:30:34Z",
   "aliases": [
     "CVE-2023-36260"
@@ -9,7 +9,10 @@
   "summary": "Craft CMS Feed-Me",
   "details": "An issue discovered in Craft CMS version 4.6.1.1 allows remote attackers to cause a denial of service (DoS) via crafted string to Feed-Me Name and Feed-Me URL fields due to saving a feed using an Asset element type with no volume selected.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
     {
@@ -41,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28%29"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/craftcms/feed-me"
@@ -56,9 +63,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-74"
     ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2024-01-30T18:42:48Z",
     "nvd_published_at": "2024-01-30T09:15:47Z"

advisories/github-reviewed/2024/01/GHSA-v89q-c273-3p42/GHSA-v89q-c273-3p42.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-v89q-c273-3p42",
-  "modified": "2024-01-30T18:42:40Z",
+  "modified": "2024-02-05T23:06:29Z",
   "published": "2024-01-30T09:30:34Z",
   "aliases": [
     "CVE-2023-36259"
@@ -9,7 +9,10 @@
   "summary": "Craft CMS Audit Plugin Cross Site Scripting vulnerability",
   "details": "Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
   ],
   "affected": [
     {
@@ -56,7 +59,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-79"
     ],
     "severity": "MODERATE",
     "github_reviewed": true,

advisories/github-reviewed/2024/02/GHSA-vh73-q3rw-qx7w/GHSA-vh73-q3rw-qx7w.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vh73-q3rw-qx7w",
-  "modified": "2024-02-05T21:30:31Z",
+  "modified": "2024-02-05T23:06:56Z",
   "published": "2024-02-05T21:30:31Z",
   "aliases": [
     "CVE-2024-1052"
   ],
+  "summary": "Boundary vulnerable to session hijacking through TLS certificate tampering",
   "details": "Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/hashicorp/boundary"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.8.0"
+            },
+            {
+              "fixed": "0.15.0"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -24,6 +43,10 @@
     {
       "type": "WEB",
       "url": "https://discuss.hashicorp.com/t/hcsec-2024-02-boundary-vulnerable-to-session-hijacking-through-tls-certificate-tampering/62458"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/hashicorp/boundary"
     }
   ],
   "database_specific": {
@@ -31,8 +54,8 @@
       "CWE-295"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-02-05T23:06:56Z",
     "nvd_published_at": "2024-02-05T21:15:11Z"
   }
 }