diff --git a/advisories/github-reviewed/2025/04/GHSA-9w85-x5hg-fr66/GHSA-9w85-x5hg-fr66.json b/advisories/github-reviewed/2025/04/GHSA-9w85-x5hg-fr66/GHSA-9w85-x5hg-fr66.json index 929ae8e89d4..3991f251e05 100644 --- a/advisories/github-reviewed/2025/04/GHSA-9w85-x5hg-fr66/GHSA-9w85-x5hg-fr66.json +++ b/advisories/github-reviewed/2025/04/GHSA-9w85-x5hg-fr66/GHSA-9w85-x5hg-fr66.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9w85-x5hg-fr66", - "modified": "2025-04-02T17:07:45Z", + "modified": "2025-04-29T20:17:26Z", "published": "2025-04-01T00:30:33Z", "aliases": [ "CVE-2025-31677" @@ -9,9 +9,13 @@ "summary": "Drupal AI Cross-Site Request Forgery (CSRF) vulnerability", "details": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery. This issue affects AI (Artificial Intelligence): from 1.0.0 before 1.0.2.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U" } ], "affected": [ @@ -53,7 +57,7 @@ "cwe_ids": [ "CWE-352" ], - "severity": "LOW", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-04-02T17:07:45Z", "nvd_published_at": "2025-03-31T22:15:20Z" diff --git a/advisories/github-reviewed/2025/04/GHSA-c8q6-wp7v-46r9/GHSA-c8q6-wp7v-46r9.json b/advisories/github-reviewed/2025/04/GHSA-c8q6-wp7v-46r9/GHSA-c8q6-wp7v-46r9.json index 502ff31b88e..cef498b744a 100644 --- a/advisories/github-reviewed/2025/04/GHSA-c8q6-wp7v-46r9/GHSA-c8q6-wp7v-46r9.json +++ b/advisories/github-reviewed/2025/04/GHSA-c8q6-wp7v-46r9/GHSA-c8q6-wp7v-46r9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c8q6-wp7v-46r9", - "modified": "2025-04-02T17:05:50Z", + "modified": "2025-04-29T20:17:48Z", "published": "2025-04-01T00:30:33Z", "aliases": [ "CVE-2025-31678" @@ -9,9 +9,13 @@ "summary": "Drupal AI Missing Authorization vulnerability", "details": "Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" + }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" } ], "affected": [ @@ -53,7 +57,7 @@ "cwe_ids": [ "CWE-862" ], - "severity": "LOW", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-04-02T17:05:49Z", "nvd_published_at": "2025-03-31T22:15:20Z" diff --git a/advisories/github-reviewed/2025/04/GHSA-m4wj-hhwj-47qp/GHSA-m4wj-hhwj-47qp.json b/advisories/github-reviewed/2025/04/GHSA-m4wj-hhwj-47qp/GHSA-m4wj-hhwj-47qp.json index ace52764d04..8f96935c807 100644 --- a/advisories/github-reviewed/2025/04/GHSA-m4wj-hhwj-47qp/GHSA-m4wj-hhwj-47qp.json +++ b/advisories/github-reviewed/2025/04/GHSA-m4wj-hhwj-47qp/GHSA-m4wj-hhwj-47qp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m4wj-hhwj-47qp", - "modified": "2025-04-01T19:06:18Z", + "modified": "2025-04-29T20:16:49Z", "published": "2025-04-01T00:30:33Z", "aliases": [ "CVE-2025-31675" @@ -9,9 +9,13 @@ "summary": "Drupal Core Cross-Site Scripting (XSS) Vulnerability", "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U" } ], "affected": [ diff --git a/advisories/github-reviewed/2025/04/GHSA-wpp8-fjgf-pwc7/GHSA-wpp8-fjgf-pwc7.json b/advisories/github-reviewed/2025/04/GHSA-wpp8-fjgf-pwc7/GHSA-wpp8-fjgf-pwc7.json index 0214e63e6f4..3df9ef4b50d 100644 --- a/advisories/github-reviewed/2025/04/GHSA-wpp8-fjgf-pwc7/GHSA-wpp8-fjgf-pwc7.json +++ b/advisories/github-reviewed/2025/04/GHSA-wpp8-fjgf-pwc7/GHSA-wpp8-fjgf-pwc7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wpp8-fjgf-pwc7", - "modified": "2025-04-01T18:03:50Z", + "modified": "2025-04-29T20:16:24Z", "published": "2025-04-01T00:30:33Z", "aliases": [ "CVE-2025-31673" @@ -9,6 +9,10 @@ "summary": "Drupal Core Vulnerable to Forceful Browsing", "details": "Incorrect Authorization vulnerability in Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"