diff --git a/advisories/github-reviewed/2024/11/GHSA-549p-5c7f-c5p4/GHSA-549p-5c7f-c5p4.json b/advisories/github-reviewed/2024/11/GHSA-549p-5c7f-c5p4/GHSA-549p-5c7f-c5p4.json new file mode 100644 index 00000000000..737fc29811d --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-549p-5c7f-c5p4/GHSA-549p-5c7f-c5p4.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-549p-5c7f-c5p4", + "modified": "2025-03-14T18:51:47Z", + "published": "2024-11-08T00:30:45Z", + "aliases": [ + "CVE-2024-51434" + ], + "summary": "Froala WYSIWYG editor allows cross-site scripting (XSS)", + "details": "Inconsistent tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "froala-editor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.3.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "froala/wysiwyg-editor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.3.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51434" + }, + { + "type": "WEB", + "url": "https://georgyg.com/home/froala-wysiwyg-editor---xss-cve-2024-51434" + }, + { + "type": "PACKAGE", + "url": "https://github.com/froala/wysiwyg-editor" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-14T18:51:47Z", + "nvd_published_at": "2024-11-07T22:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-mrxw-mxhj-p664/GHSA-mrxw-mxhj-p664.json b/advisories/github-reviewed/2025/03/GHSA-mrxw-mxhj-p664/GHSA-mrxw-mxhj-p664.json new file mode 100644 index 00000000000..2081d15a57b --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-mrxw-mxhj-p664/GHSA-mrxw-mxhj-p664.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mrxw-mxhj-p664", + "modified": "2025-03-14T18:51:37Z", + "published": "2025-03-14T18:51:37Z", + "aliases": [], + "summary": "Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs", + "details": "## Summary\n\nNokogiri v1.18.4 upgrades its dependency libxslt to [v1.1.43](https://gitlab.gnome.org/GNOME/libxslt/-/releases/v1.1.43).\n\nlibxslt v1.1.43 resolves:\n\n- CVE-2025-24855: Fix use-after-free of XPath context node\n- CVE-2024-55549: Fix UAF related to excluded namespaces\n\n## Impact\n\n### CVE-2025-24855\n\n- \"Use-after-free due to xsltEvalXPathStringNs leaking xpathCtxt->node\"\n- MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H\n- Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/128\n- NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2025-24855\n\n### CVE-2024-55549\n\n- \"Use-after-free related to excluded result prefixes\"\n- MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H\n- Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/127\n- NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2024-55549", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "nokogiri" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.18.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-mrxw-mxhj-p664" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55549" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24855" + }, + { + "type": "PACKAGE", + "url": "https://github.com/sparklemotion/nokogiri" + }, + { + "type": "WEB", + "url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/127" + }, + { + "type": "WEB", + "url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/128" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1395", + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-14T18:51:37Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-549p-5c7f-c5p4/GHSA-549p-5c7f-c5p4.json b/advisories/unreviewed/2024/11/GHSA-549p-5c7f-c5p4/GHSA-549p-5c7f-c5p4.json deleted file mode 100644 index 9e1da401a62..00000000000 --- a/advisories/unreviewed/2024/11/GHSA-549p-5c7f-c5p4/GHSA-549p-5c7f-c5p4.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-549p-5c7f-c5p4", - "modified": "2024-11-08T18:30:49Z", - "published": "2024-11-08T00:30:45Z", - "aliases": [ - "CVE-2024-51434" - ], - "details": "Inconsistent <plaintext> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51434" - }, - { - "type": "WEB", - "url": "https://georgyg.com/home/froala-wysiwyg-editor---xss-cve-2024-51434" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-11-07T22:15:21Z" - } -} \ No newline at end of file