diff --git a/advisories/github-reviewed/2024/11/GHSA-hv6m-qj65-26q3/GHSA-hv6m-qj65-26q3.json b/advisories/github-reviewed/2024/11/GHSA-hv6m-qj65-26q3/GHSA-hv6m-qj65-26q3.json new file mode 100644 index 00000000000..1b09e1b70b3 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-hv6m-qj65-26q3/GHSA-hv6m-qj65-26q3.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hv6m-qj65-26q3", + "modified": "2024-11-06T20:21:56Z", + "published": "2024-11-06T18:31:11Z", + "aliases": [ + "CVE-2024-50637" + ], + "summary": "UnoPim Cross-site Scripting vulnerability", + "details": "UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function.\n\nThe vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "unopim/unopim" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.1.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50637" + }, + { + "type": "WEB", + "url": "https://github.com/unopim/unopim/issues/41" + }, + { + "type": "PACKAGE", + "url": "https://github.com/unopim/unopim" + }, + { + "type": "WEB", + "url": "https://github.com/unopim/unopim/releases/tag/v0.1.4" + }, + { + "type": "WEB", + "url": "https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Unopim/Findings.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-06T20:21:56Z", + "nvd_published_at": "2024-11-06T17:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hv6m-qj65-26q3/GHSA-hv6m-qj65-26q3.json b/advisories/unreviewed/2024/11/GHSA-hv6m-qj65-26q3/GHSA-hv6m-qj65-26q3.json deleted file mode 100644 index 78bd150c2ca..00000000000 --- a/advisories/unreviewed/2024/11/GHSA-hv6m-qj65-26q3/GHSA-hv6m-qj65-26q3.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hv6m-qj65-26q3", - "modified": "2024-11-06T18:31:11Z", - "published": "2024-11-06T18:31:11Z", - "aliases": [ - "CVE-2024-50637" - ], - "details": "UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. ΒΆΒΆ The vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50637" - }, - { - "type": "WEB", - "url": "https://github.com/unopim/unopim/issues/41" - }, - { - "type": "WEB", - "url": "https://github.com/unopim/unopim/releases/tag/v0.1.4" - }, - { - "type": "WEB", - "url": "https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Unopim/Findings.md" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-11-06T17:15:20Z" - } -} \ No newline at end of file