From 3ae4707b7993b7275c651f35c126638c15bbce12 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 25 Jul 2024 03:33:12 +0000
Subject: [PATCH] Publish Advisories

GHSA-h3pp-hqpg-9qmw
GHSA-x8pf-46vx-rg97
---
 .../GHSA-h3pp-hqpg-9qmw.json                  | 42 +++++++++++++++++++
 .../GHSA-x8pf-46vx-rg97.json                  | 38 +++++++++++++++++
 2 files changed, 80 insertions(+)
 create mode 100644 advisories/unreviewed/2024/07/GHSA-h3pp-hqpg-9qmw/GHSA-h3pp-hqpg-9qmw.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-x8pf-46vx-rg97/GHSA-x8pf-46vx-rg97.json

diff --git a/advisories/unreviewed/2024/07/GHSA-h3pp-hqpg-9qmw/GHSA-h3pp-hqpg-9qmw.json b/advisories/unreviewed/2024/07/GHSA-h3pp-hqpg-9qmw/GHSA-h3pp-hqpg-9qmw.json
new file mode 100644
index 00000000000..dff78fa751d
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-h3pp-hqpg-9qmw/GHSA-h3pp-hqpg-9qmw.json
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h3pp-hqpg-9qmw",
+  "modified": "2024-07-25T03:31:42Z",
+  "published": "2024-07-25T03:31:42Z",
+  "aliases": [
+    "CVE-2024-7057"
+  ],
+  "details": "An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where job artifacts can be inappropriately exposed to users lacking the proper authorization level.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7057"
+    },
+    {
+      "type": "WEB",
+      "url": "https://hackerone.com/reports/2475135"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/458501"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-25T01:15:10Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-x8pf-46vx-rg97/GHSA-x8pf-46vx-rg97.json b/advisories/unreviewed/2024/07/GHSA-x8pf-46vx-rg97/GHSA-x8pf-46vx-rg97.json
new file mode 100644
index 00000000000..8437ffa8fa4
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-x8pf-46vx-rg97/GHSA-x8pf-46vx-rg97.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x8pf-46vx-rg97",
+  "modified": "2024-07-25T03:31:42Z",
+  "published": "2024-07-25T03:31:42Z",
+  "aliases": [
+    "CVE-2024-7047"
+  ],
+  "details": "A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7047"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/455318"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-25T01:15:09Z"
+  }
+}
\ No newline at end of file