Publish Advisories

GHSA-hv6m-qj65-26q3 GHSA-hv6m-qj65-26q3
2026-05-22 18:04:22 -07:00 · 2024-11-06 20:23:28 +00:00
parent 1a729ca3d5
commit 28b9b2b05a
2 changed files with 73 additions and 43 deletions
@@ -0,0 +1,73 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hv6m-qj65-26q3",
+  "modified": "2024-11-06T20:21:56Z",
+  "published": "2024-11-06T18:31:11Z",
+  "aliases": [
+    "CVE-2024-50637"
+  ],
+  "summary": "UnoPim Cross-site Scripting vulnerability",
+  "details": "UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function.\n\nThe vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "unopim/unopim"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.1.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50637"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/unopim/unopim/issues/41"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/unopim/unopim"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/unopim/unopim/releases/tag/v0.1.4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Unopim/Findings.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-11-06T20:21:56Z",
+    "nvd_published_at": "2024-11-06T17:15:20Z"
+  }
+}
@@ -1,43 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-hv6m-qj65-26q3",
-  "modified": "2024-11-06T18:31:11Z",
-  "published": "2024-11-06T18:31:11Z",
-  "aliases": [
-    "CVE-2024-50637"
-  ],
-  "details": "UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. ¶¶ The vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50637"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/unopim/unopim/issues/41"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/unopim/unopim/releases/tag/v0.1.4"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Unopim/Findings.md"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-
-    ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-11-06T17:15:20Z"
-  }
-}