From 2ed892b589dce382a7216c9b6a987830f3a2ea07 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 14 Apr 2025 22:09:01 +0000 Subject: [PATCH] Publish Advisories GHSA-4pc3-96mx-wwc8 GHSA-5f37-gxvh-23v6 GHSA-g27j-74fp-xfpr GHSA-jvgm-pfqv-887x GHSA-pr44-4jfr-286m GHSA-45rm-2893-5f49 GHSA-vc8w-jr9v-vj7f --- .../GHSA-4pc3-96mx-wwc8.json | 14 +------------- .../GHSA-5f37-gxvh-23v6.json | 17 +++-------------- .../GHSA-g27j-74fp-xfpr.json | 8 +++++--- .../GHSA-jvgm-pfqv-887x.json | 2 +- .../GHSA-pr44-4jfr-286m.json | 2 +- .../GHSA-45rm-2893-5f49.json | 2 +- .../GHSA-vc8w-jr9v-vj7f.json | 6 +++++- 7 files changed, 17 insertions(+), 34 deletions(-) diff --git a/advisories/github-reviewed/2020/03/GHSA-4pc3-96mx-wwc8/GHSA-4pc3-96mx-wwc8.json b/advisories/github-reviewed/2020/03/GHSA-4pc3-96mx-wwc8/GHSA-4pc3-96mx-wwc8.json index 0473920aad5..1e31c889521 100644 --- a/advisories/github-reviewed/2020/03/GHSA-4pc3-96mx-wwc8/GHSA-4pc3-96mx-wwc8.json +++ b/advisories/github-reviewed/2020/03/GHSA-4pc3-96mx-wwc8/GHSA-4pc3-96mx-wwc8.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4pc3-96mx-wwc8", - "modified": "2023-09-06T13:48:23Z", + "modified": "2025-04-14T22:05:57Z", "published": "2020-03-05T22:09:14Z", "aliases": [ "CVE-2016-10045" @@ -99,18 +99,6 @@ { "type": "WEB", "url": "http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/archive/1/539967/100/0/threaded" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/95130" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1037533" } ], "database_specific": { diff --git a/advisories/github-reviewed/2020/03/GHSA-5f37-gxvh-23v6/GHSA-5f37-gxvh-23v6.json b/advisories/github-reviewed/2020/03/GHSA-5f37-gxvh-23v6/GHSA-5f37-gxvh-23v6.json index 56a74b9ef8a..671c0cde4ca 100644 --- a/advisories/github-reviewed/2020/03/GHSA-5f37-gxvh-23v6/GHSA-5f37-gxvh-23v6.json +++ b/advisories/github-reviewed/2020/03/GHSA-5f37-gxvh-23v6/GHSA-5f37-gxvh-23v6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-5f37-gxvh-23v6", - "modified": "2023-09-06T13:51:03Z", + "modified": "2025-04-14T22:06:13Z", "published": "2020-03-05T22:09:17Z", "aliases": [ "CVE-2016-10033" @@ -123,23 +123,12 @@ { "type": "WEB", "url": "http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/archive/1/539963/100/0/threaded" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/95108" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1037533" } ], "database_specific": { "cwe_ids": [ - "CWE-77" + "CWE-77", + "CWE-88" ], "severity": "CRITICAL", "github_reviewed": true, diff --git a/advisories/github-reviewed/2022/04/GHSA-g27j-74fp-xfpr/GHSA-g27j-74fp-xfpr.json b/advisories/github-reviewed/2022/04/GHSA-g27j-74fp-xfpr/GHSA-g27j-74fp-xfpr.json index 0986bb5c88b..16f3d610b5f 100644 --- a/advisories/github-reviewed/2022/04/GHSA-g27j-74fp-xfpr/GHSA-g27j-74fp-xfpr.json +++ b/advisories/github-reviewed/2022/04/GHSA-g27j-74fp-xfpr/GHSA-g27j-74fp-xfpr.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-g27j-74fp-xfpr", - "modified": "2023-01-10T00:37:19Z", + "modified": "2025-04-14T22:07:39Z", "published": "2022-04-05T18:31:22Z", "aliases": [ "CVE-2022-26969" ], "summary": "Insecure default value for CORS configuration", - "details": "### Impact\n\nThe default value for the `CORS_ENABLED` and `CORS_ORIGIN` configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed.\n\n### Patches\n\nThe default values for CORS have been changed in https://github.com/directus/directus/pull/12022 which is released under 9.7.0\n\n### Workarounds\n\nConfigure the CORS environment variables to match your project's usage, rather than leaving them at the (permissive) defaults.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [directus/directus](https://github.com/directus/directus)\n* Email us at [security@directus.io](mailto:security@directus.io)\n", + "details": "### Impact\n\nThe default value for the `CORS_ENABLED` and `CORS_ORIGIN` configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed.\n\n### Patches\n\nThe default values for CORS have been changed in https://github.com/directus/directus/pull/12022 which is released under 9.7.0\n\n### Workarounds\n\nConfigure the CORS environment variables to match your project's usage, rather than leaving them at the (permissive) defaults.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [directus/directus](https://github.com/directus/directus)\n* Email us at [security@directus.io](mailto:security@directus.io)", "severity": [ { "type": "CVSS_V3", @@ -70,7 +70,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-942" + ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2022-04-05T18:31:22Z", diff --git a/advisories/github-reviewed/2022/05/GHSA-jvgm-pfqv-887x/GHSA-jvgm-pfqv-887x.json b/advisories/github-reviewed/2022/05/GHSA-jvgm-pfqv-887x/GHSA-jvgm-pfqv-887x.json index ca4fffc8298..a738bdb8a16 100644 --- a/advisories/github-reviewed/2022/05/GHSA-jvgm-pfqv-887x/GHSA-jvgm-pfqv-887x.json +++ b/advisories/github-reviewed/2022/05/GHSA-jvgm-pfqv-887x/GHSA-jvgm-pfqv-887x.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jvgm-pfqv-887x", - "modified": "2023-06-23T21:46:31Z", + "modified": "2025-04-14T22:05:18Z", "published": "2022-05-14T00:57:16Z", "aliases": [ "CVE-2016-7954" diff --git a/advisories/github-reviewed/2022/05/GHSA-pr44-4jfr-286m/GHSA-pr44-4jfr-286m.json b/advisories/github-reviewed/2022/05/GHSA-pr44-4jfr-286m/GHSA-pr44-4jfr-286m.json index 70cd07ef736..7b423285681 100644 --- a/advisories/github-reviewed/2022/05/GHSA-pr44-4jfr-286m/GHSA-pr44-4jfr-286m.json +++ b/advisories/github-reviewed/2022/05/GHSA-pr44-4jfr-286m/GHSA-pr44-4jfr-286m.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-pr44-4jfr-286m", - "modified": "2024-04-24T22:03:24Z", + "modified": "2025-04-14T22:05:40Z", "published": "2022-05-17T00:27:49Z", "aliases": [ "CVE-2016-10074" diff --git a/advisories/github-reviewed/2022/12/GHSA-45rm-2893-5f49/GHSA-45rm-2893-5f49.json b/advisories/github-reviewed/2022/12/GHSA-45rm-2893-5f49/GHSA-45rm-2893-5f49.json index f91c6a9d772..e84ba137e99 100644 --- a/advisories/github-reviewed/2022/12/GHSA-45rm-2893-5f49/GHSA-45rm-2893-5f49.json +++ b/advisories/github-reviewed/2022/12/GHSA-45rm-2893-5f49/GHSA-45rm-2893-5f49.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-45rm-2893-5f49", - "modified": "2023-01-02T21:15:49Z", + "modified": "2025-04-14T22:08:07Z", "published": "2022-12-22T06:30:15Z", "aliases": [ "CVE-2022-25948" diff --git a/advisories/github-reviewed/2024/07/GHSA-vc8w-jr9v-vj7f/GHSA-vc8w-jr9v-vj7f.json b/advisories/github-reviewed/2024/07/GHSA-vc8w-jr9v-vj7f/GHSA-vc8w-jr9v-vj7f.json index aaf9e68f12a..50fdb5d47aa 100644 --- a/advisories/github-reviewed/2024/07/GHSA-vc8w-jr9v-vj7f/GHSA-vc8w-jr9v-vj7f.json +++ b/advisories/github-reviewed/2024/07/GHSA-vc8w-jr9v-vj7f/GHSA-vc8w-jr9v-vj7f.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vc8w-jr9v-vj7f", - "modified": "2024-09-06T19:07:44Z", + "modified": "2025-04-14T22:07:28Z", "published": "2024-07-11T18:31:14Z", "aliases": [ "CVE-2024-6531" @@ -187,6 +187,10 @@ "type": "PACKAGE", "url": "https://github.com/twbs/bootstrap" }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00021.html" + }, { "type": "WEB", "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-6531"