diff --git a/advisories/github-reviewed/2024/02/GHSA-h3rw-77w7-92gf/GHSA-h3rw-77w7-92gf.json b/advisories/github-reviewed/2024/02/GHSA-h3rw-77w7-92gf/GHSA-h3rw-77w7-92gf.json index de547cc95f8..d7e530aec15 100644 --- a/advisories/github-reviewed/2024/02/GHSA-h3rw-77w7-92gf/GHSA-h3rw-77w7-92gf.json +++ b/advisories/github-reviewed/2024/02/GHSA-h3rw-77w7-92gf/GHSA-h3rw-77w7-92gf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-h3rw-77w7-92gf", - "modified": "2024-02-12T17:22:18Z", + "modified": "2024-08-02T16:00:22Z", "published": "2024-02-11T06:30:27Z", "aliases": [ "CVE-2024-25718" @@ -9,7 +9,14 @@ "summary": "Samly access control vulnerability", "details": "In the Samly package before 1.4.0 for Elixir, `Samly.State.Store.get_assertion/3` can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -68,9 +75,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-400" ], - "severity": "MODERATE", + "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2024-02-12T17:22:18Z", "nvd_published_at": "2024-02-11T05:15:08Z" diff --git a/advisories/github-reviewed/2024/03/GHSA-2whx-ccr7-fxqm/GHSA-2whx-ccr7-fxqm.json b/advisories/github-reviewed/2024/03/GHSA-2whx-ccr7-fxqm/GHSA-2whx-ccr7-fxqm.json index 7e425308851..6f5160adf00 100644 --- a/advisories/github-reviewed/2024/03/GHSA-2whx-ccr7-fxqm/GHSA-2whx-ccr7-fxqm.json +++ b/advisories/github-reviewed/2024/03/GHSA-2whx-ccr7-fxqm/GHSA-2whx-ccr7-fxqm.json @@ -1,17 +1,21 @@ { "schema_version": "1.4.0", "id": "GHSA-2whx-ccr7-fxqm", - "modified": "2024-03-22T20:56:56Z", + "modified": "2024-08-02T16:00:49Z", "published": "2024-03-22T18:30:31Z", "aliases": [ "CVE-2024-29338" ], "summary": "Cross-Site Request Forgery in Anchor CMS", - "details": "Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2.", + "details": "Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via `/anchor/admin/categories/delete/2`.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" } ], "affected": [ diff --git a/advisories/github-reviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json b/advisories/github-reviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json index a75de985dc3..3e590284c97 100644 --- a/advisories/github-reviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json +++ b/advisories/github-reviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8ppr-www8-hfjx", - "modified": "2024-03-25T19:34:46Z", + "modified": "2024-08-02T15:59:13Z", "published": "2024-03-25T15:30:41Z", "aliases": [ "CVE-2024-29650" @@ -9,7 +9,14 @@ "summary": "@thi.ng/paths Prototype Pollution vulnerability", "details": "An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the `mutIn` and `mutInManyUnsafe` components.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -62,7 +69,7 @@ "cwe_ids": [ "CWE-1321" ], - "severity": "HIGH", + "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2024-03-25T19:34:46Z", "nvd_published_at": "2024-03-25T15:15:52Z" diff --git a/advisories/github-reviewed/2024/03/GHSA-8r5j-gm3j-cx9c/GHSA-8r5j-gm3j-cx9c.json b/advisories/github-reviewed/2024/03/GHSA-8r5j-gm3j-cx9c/GHSA-8r5j-gm3j-cx9c.json index cfdcd1d8dde..f86ee50e587 100644 --- a/advisories/github-reviewed/2024/03/GHSA-8r5j-gm3j-cx9c/GHSA-8r5j-gm3j-cx9c.json +++ b/advisories/github-reviewed/2024/03/GHSA-8r5j-gm3j-cx9c/GHSA-8r5j-gm3j-cx9c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8r5j-gm3j-cx9c", - "modified": "2024-04-01T15:12:59Z", + "modified": "2024-08-02T15:59:38Z", "published": "2024-03-29T18:30:42Z", "aliases": [ "CVE-2024-29686" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ @@ -59,7 +63,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-75" + "CWE-75", + "CWE-97" ], "severity": "HIGH", "github_reviewed": true, diff --git a/advisories/github-reviewed/2024/05/GHSA-gwf6-q6c2-94p3/GHSA-gwf6-q6c2-94p3.json b/advisories/github-reviewed/2024/05/GHSA-gwf6-q6c2-94p3/GHSA-gwf6-q6c2-94p3.json index a3671de7037..7e62baf1e5d 100644 --- a/advisories/github-reviewed/2024/05/GHSA-gwf6-q6c2-94p3/GHSA-gwf6-q6c2-94p3.json +++ b/advisories/github-reviewed/2024/05/GHSA-gwf6-q6c2-94p3/GHSA-gwf6-q6c2-94p3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-gwf6-q6c2-94p3", - "modified": "2024-06-04T17:35:49Z", + "modified": "2024-08-02T15:59:56Z", "published": "2024-05-31T21:30:55Z", "aliases": [ "CVE-2024-34009" @@ -9,7 +9,14 @@ "summary": "Moodle ReCAPTCHA can be bypassed on the login page", "details": "Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -54,7 +61,7 @@ "cwe_ids": [ "CWE-20" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-06-04T17:35:49Z", "nvd_published_at": "2024-05-31T21:15:09Z"