diff --git a/advisories/unreviewed/2025/02/GHSA-7qgg-vw88-cc99/GHSA-7qgg-vw88-cc99.json b/advisories/github-reviewed/2025/02/GHSA-7qgg-vw88-cc99/GHSA-7qgg-vw88-cc99.json similarity index 61% rename from advisories/unreviewed/2025/02/GHSA-7qgg-vw88-cc99/GHSA-7qgg-vw88-cc99.json rename to advisories/github-reviewed/2025/02/GHSA-7qgg-vw88-cc99/GHSA-7qgg-vw88-cc99.json index aa5038bcf05..4b0825a75ae 100644 --- a/advisories/unreviewed/2025/02/GHSA-7qgg-vw88-cc99/GHSA-7qgg-vw88-cc99.json +++ b/advisories/github-reviewed/2025/02/GHSA-7qgg-vw88-cc99/GHSA-7qgg-vw88-cc99.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-7qgg-vw88-cc99", - "modified": "2025-02-06T15:32:52Z", + "modified": "2025-02-06T23:31:52Z", "published": "2025-02-06T06:31:26Z", "aliases": [ "CVE-2024-57077" ], + "summary": "utils-extend Prototype Pollution", "details": "The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "utils-extend" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.0.8" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -22,6 +43,10 @@ { "type": "WEB", "url": "https://gist.github.com/tariqhawis/64bac50f8c2706e6880e45d50a507114" + }, + { + "type": "PACKAGE", + "url": "https://github.com/douzi8/utils-extend" } ], "database_specific": { @@ -29,8 +54,8 @@ "CWE-1321" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-06T23:31:52Z", "nvd_published_at": "2025-02-05T22:15:31Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-ggv3-vmgw-xv2q/GHSA-ggv3-vmgw-xv2q.json b/advisories/github-reviewed/2025/02/GHSA-ggv3-vmgw-xv2q/GHSA-ggv3-vmgw-xv2q.json similarity index 57% rename from advisories/unreviewed/2025/02/GHSA-ggv3-vmgw-xv2q/GHSA-ggv3-vmgw-xv2q.json rename to advisories/github-reviewed/2025/02/GHSA-ggv3-vmgw-xv2q/GHSA-ggv3-vmgw-xv2q.json index 9517ceeec64..284e93dfd27 100644 --- a/advisories/unreviewed/2025/02/GHSA-ggv3-vmgw-xv2q/GHSA-ggv3-vmgw-xv2q.json +++ b/advisories/github-reviewed/2025/02/GHSA-ggv3-vmgw-xv2q/GHSA-ggv3-vmgw-xv2q.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-ggv3-vmgw-xv2q", - "modified": "2025-02-06T18:31:05Z", + "modified": "2025-02-06T23:30:29Z", "published": "2025-02-06T06:31:25Z", "aliases": [ "CVE-2024-57068" ], + "summary": "@tanstack/form-core prototype pollution", "details": "A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@tanstack/form-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.41.3" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -22,6 +43,10 @@ { "type": "WEB", "url": "https://gist.github.com/tariqhawis/47fe5b1e584e9e573c0933588248d533" + }, + { + "type": "PACKAGE", + "url": "https://github.com/TanStack/form" } ], "database_specific": { @@ -29,8 +54,8 @@ "CWE-732" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-06T23:30:29Z", "nvd_published_at": "2025-02-05T22:15:31Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-q5j8-9m9g-x2jh/GHSA-q5j8-9m9g-x2jh.json b/advisories/github-reviewed/2025/02/GHSA-q5j8-9m9g-x2jh/GHSA-q5j8-9m9g-x2jh.json similarity index 56% rename from advisories/unreviewed/2025/02/GHSA-q5j8-9m9g-x2jh/GHSA-q5j8-9m9g-x2jh.json rename to advisories/github-reviewed/2025/02/GHSA-q5j8-9m9g-x2jh/GHSA-q5j8-9m9g-x2jh.json index 153033c4df3..34fe8afd3dd 100644 --- a/advisories/unreviewed/2025/02/GHSA-q5j8-9m9g-x2jh/GHSA-q5j8-9m9g-x2jh.json +++ b/advisories/github-reviewed/2025/02/GHSA-q5j8-9m9g-x2jh/GHSA-q5j8-9m9g-x2jh.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-q5j8-9m9g-x2jh", - "modified": "2025-02-06T18:31:05Z", + "modified": "2025-02-06T23:30:54Z", "published": "2025-02-06T06:31:25Z", "aliases": [ "CVE-2024-57072" ], + "summary": "module-from-string prototype pollution", "details": "A prototype pollution in the lib.requireFromString function of module-from-string v3.3.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "module-from-string" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "3.3.1" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -22,6 +43,10 @@ { "type": "WEB", "url": "https://gist.github.com/tariqhawis/8b1fe301dd1ea52952cef347daddee67" + }, + { + "type": "PACKAGE", + "url": "https://github.com/exuanbo/module-from-string" } ], "database_specific": { @@ -29,8 +54,8 @@ "CWE-1321" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-06T23:30:54Z", "nvd_published_at": "2025-02-05T22:15:31Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-r7jx-5m6m-cpg9/GHSA-r7jx-5m6m-cpg9.json b/advisories/github-reviewed/2025/02/GHSA-r7jx-5m6m-cpg9/GHSA-r7jx-5m6m-cpg9.json similarity index 56% rename from advisories/unreviewed/2025/02/GHSA-r7jx-5m6m-cpg9/GHSA-r7jx-5m6m-cpg9.json rename to advisories/github-reviewed/2025/02/GHSA-r7jx-5m6m-cpg9/GHSA-r7jx-5m6m-cpg9.json index 53841296395..8008e1a1279 100644 --- a/advisories/unreviewed/2025/02/GHSA-r7jx-5m6m-cpg9/GHSA-r7jx-5m6m-cpg9.json +++ b/advisories/github-reviewed/2025/02/GHSA-r7jx-5m6m-cpg9/GHSA-r7jx-5m6m-cpg9.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-r7jx-5m6m-cpg9", - "modified": "2025-02-06T15:32:52Z", + "modified": "2025-02-06T23:31:34Z", "published": "2025-02-06T06:31:26Z", "aliases": [ "CVE-2024-57075" ], + "summary": "eazy-logger prototype pollution", "details": "A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "eazy-logger" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.0.1" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -22,6 +43,10 @@ { "type": "WEB", "url": "https://gist.github.com/tariqhawis/c601f7f85146510ca899a7406a03aba5" + }, + { + "type": "PACKAGE", + "url": "https://github.com/shakyShane/eazy-logger" } ], "database_specific": { @@ -29,8 +54,8 @@ "CWE-1321" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-06T23:31:34Z", "nvd_published_at": "2025-02-05T22:15:31Z" } } \ No newline at end of file