From 28b9b2b05aa4427e9f1a291890813adc44adf2d0 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 6 Nov 2024 20:23:28 +0000
Subject: [PATCH] Publish Advisories

GHSA-hv6m-qj65-26q3
GHSA-hv6m-qj65-26q3
---
 .../GHSA-hv6m-qj65-26q3.json                  | 73 +++++++++++++++++++
 .../GHSA-hv6m-qj65-26q3.json                  | 43 -----------
 2 files changed, 73 insertions(+), 43 deletions(-)
 create mode 100644 advisories/github-reviewed/2024/11/GHSA-hv6m-qj65-26q3/GHSA-hv6m-qj65-26q3.json
 delete mode 100644 advisories/unreviewed/2024/11/GHSA-hv6m-qj65-26q3/GHSA-hv6m-qj65-26q3.json

diff --git a/advisories/github-reviewed/2024/11/GHSA-hv6m-qj65-26q3/GHSA-hv6m-qj65-26q3.json b/advisories/github-reviewed/2024/11/GHSA-hv6m-qj65-26q3/GHSA-hv6m-qj65-26q3.json
new file mode 100644
index 00000000000..1b09e1b70b3
--- /dev/null
+++ b/advisories/github-reviewed/2024/11/GHSA-hv6m-qj65-26q3/GHSA-hv6m-qj65-26q3.json
@@ -0,0 +1,73 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hv6m-qj65-26q3",
+  "modified": "2024-11-06T20:21:56Z",
+  "published": "2024-11-06T18:31:11Z",
+  "aliases": [
+    "CVE-2024-50637"
+  ],
+  "summary": "UnoPim Cross-site Scripting vulnerability",
+  "details": "UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function.\n\nThe vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "unopim/unopim"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.1.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50637"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/unopim/unopim/issues/41"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/unopim/unopim"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/unopim/unopim/releases/tag/v0.1.4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Unopim/Findings.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-11-06T20:21:56Z",
+    "nvd_published_at": "2024-11-06T17:15:20Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/11/GHSA-hv6m-qj65-26q3/GHSA-hv6m-qj65-26q3.json b/advisories/unreviewed/2024/11/GHSA-hv6m-qj65-26q3/GHSA-hv6m-qj65-26q3.json
deleted file mode 100644
index 78bd150c2ca..00000000000
--- a/advisories/unreviewed/2024/11/GHSA-hv6m-qj65-26q3/GHSA-hv6m-qj65-26q3.json
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-hv6m-qj65-26q3",
-  "modified": "2024-11-06T18:31:11Z",
-  "published": "2024-11-06T18:31:11Z",
-  "aliases": [
-    "CVE-2024-50637"
-  ],
-  "details": "UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. ¶¶ The vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50637"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/unopim/unopim/issues/41"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/unopim/unopim/releases/tag/v0.1.4"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Unopim/Findings.md"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-
-    ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-11-06T17:15:20Z"
-  }
-}
\ No newline at end of file