From 375951cb6bddb666aee753693a9863ceba9b4e19 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 23 Jan 2025 23:16:06 +0000 Subject: [PATCH] Publish Advisories GHSA-36gq-35j3-p9r9 GHSA-788m-27g4-cf86 GHSA-969g-rq57-c79h GHSA-gp8p-49gr-jv8j GHSA-xhgq-h98j-859v --- .../01/GHSA-36gq-35j3-p9r9/GHSA-36gq-35j3-p9r9.json | 9 +++++++-- .../01/GHSA-788m-27g4-cf86/GHSA-788m-27g4-cf86.json | 6 +++++- .../01/GHSA-969g-rq57-c79h/GHSA-969g-rq57-c79h.json | 4 +++- .../01/GHSA-gp8p-49gr-jv8j/GHSA-gp8p-49gr-jv8j.json | 13 ++++++++++--- .../01/GHSA-xhgq-h98j-859v/GHSA-xhgq-h98j-859v.json | 3 ++- 5 files changed, 27 insertions(+), 8 deletions(-) diff --git a/advisories/github-reviewed/2025/01/GHSA-36gq-35j3-p9r9/GHSA-36gq-35j3-p9r9.json b/advisories/github-reviewed/2025/01/GHSA-36gq-35j3-p9r9/GHSA-36gq-35j3-p9r9.json index 8ced4b8d480..b5280e35154 100644 --- a/advisories/github-reviewed/2025/01/GHSA-36gq-35j3-p9r9/GHSA-36gq-35j3-p9r9.json +++ b/advisories/github-reviewed/2025/01/GHSA-36gq-35j3-p9r9/GHSA-36gq-35j3-p9r9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-36gq-35j3-p9r9", - "modified": "2025-01-21T20:24:02Z", + "modified": "2025-01-23T23:14:08Z", "published": "2025-01-21T20:24:02Z", "aliases": [ "CVE-2024-10846" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/compose-spec/compose-go/security/advisories/GHSA-36gq-35j3-p9r9" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10846" + }, { "type": "WEB", "url": "https://github.com/docker/compose/issues/12235" @@ -63,11 +67,12 @@ ], "database_specific": { "cwe_ids": [ + "CWE-20", "CWE-400" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-01-21T20:24:02Z", - "nvd_published_at": null + "nvd_published_at": "2025-01-23T16:15:33Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-788m-27g4-cf86/GHSA-788m-27g4-cf86.json b/advisories/github-reviewed/2025/01/GHSA-788m-27g4-cf86/GHSA-788m-27g4-cf86.json index 752ebfe3d2d..e1c75080308 100644 --- a/advisories/github-reviewed/2025/01/GHSA-788m-27g4-cf86/GHSA-788m-27g4-cf86.json +++ b/advisories/github-reviewed/2025/01/GHSA-788m-27g4-cf86/GHSA-788m-27g4-cf86.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-788m-27g4-cf86", - "modified": "2025-01-22T22:00:04Z", + "modified": "2025-01-23T23:14:15Z", "published": "2025-01-22T21:30:57Z", "aliases": [ "CVE-2024-56923" @@ -9,6 +9,10 @@ "summary": "Cross site scripting in Silverpeas Core", "details": "Stored Cross-Site Scripting (XSS) in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The attack can lead to session hijacking, data theft, or unauthorized actions when an admin user views the affected subscription.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" diff --git a/advisories/github-reviewed/2025/01/GHSA-969g-rq57-c79h/GHSA-969g-rq57-c79h.json b/advisories/github-reviewed/2025/01/GHSA-969g-rq57-c79h/GHSA-969g-rq57-c79h.json index 6ed4b1ba82d..00f17439dfc 100644 --- a/advisories/github-reviewed/2025/01/GHSA-969g-rq57-c79h/GHSA-969g-rq57-c79h.json +++ b/advisories/github-reviewed/2025/01/GHSA-969g-rq57-c79h/GHSA-969g-rq57-c79h.json @@ -50,7 +50,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-863" + ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-01-22T19:30:30Z", diff --git a/advisories/github-reviewed/2025/01/GHSA-gp8p-49gr-jv8j/GHSA-gp8p-49gr-jv8j.json b/advisories/github-reviewed/2025/01/GHSA-gp8p-49gr-jv8j/GHSA-gp8p-49gr-jv8j.json index 083bc62ff1a..649a64acc49 100644 --- a/advisories/github-reviewed/2025/01/GHSA-gp8p-49gr-jv8j/GHSA-gp8p-49gr-jv8j.json +++ b/advisories/github-reviewed/2025/01/GHSA-gp8p-49gr-jv8j/GHSA-gp8p-49gr-jv8j.json @@ -1,14 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-gp8p-49gr-jv8j", - "modified": "2025-01-22T19:32:51Z", + "modified": "2025-01-23T23:14:13Z", "published": "2025-01-22T18:31:56Z", "aliases": [ "CVE-2025-24403" ], "summary": "Missing permission checks in Jenkins Azure Service Fabric Plugin ", "details": "The Jenkins Azure Service Fabric Plugin 1.6 and earlier does not perform permission checks in several HTTP endpoints.\n\nThis allows attackers with Overall/Read permission to enumerate credentials IDs of Azure credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.\n", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], "affected": [ { "package": { @@ -45,7 +50,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-862" + ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-01-22T19:32:51Z", diff --git a/advisories/github-reviewed/2025/01/GHSA-xhgq-h98j-859v/GHSA-xhgq-h98j-859v.json b/advisories/github-reviewed/2025/01/GHSA-xhgq-h98j-859v/GHSA-xhgq-h98j-859v.json index 1f245d1c0a5..da880417b94 100644 --- a/advisories/github-reviewed/2025/01/GHSA-xhgq-h98j-859v/GHSA-xhgq-h98j-859v.json +++ b/advisories/github-reviewed/2025/01/GHSA-xhgq-h98j-859v/GHSA-xhgq-h98j-859v.json @@ -51,7 +51,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-285" + "CWE-285", + "CWE-863" ], "severity": "MODERATE", "github_reviewed": true,