From 3d0ed95ed5e3b0fe7ba1e13daf4aeb331dc69a88 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 14 Feb 2025 18:07:25 +0000
Subject: [PATCH] Publish Advisories

GHSA-8355-xj3p-hv6q
GHSA-vhxf-7vqr-mrjg
---
 .../GHSA-8355-xj3p-hv6q.json                  | 37 +++++++++++++++++--
 .../GHSA-vhxf-7vqr-mrjg.json                  | 33 +++++++++++++++--
 2 files changed, 62 insertions(+), 8 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2025/02/GHSA-8355-xj3p-hv6q/GHSA-8355-xj3p-hv6q.json (61%)
 rename advisories/{unreviewed => github-reviewed}/2025/02/GHSA-vhxf-7vqr-mrjg/GHSA-vhxf-7vqr-mrjg.json (64%)

diff --git a/advisories/unreviewed/2025/02/GHSA-8355-xj3p-hv6q/GHSA-8355-xj3p-hv6q.json b/advisories/github-reviewed/2025/02/GHSA-8355-xj3p-hv6q/GHSA-8355-xj3p-hv6q.json
similarity index 61%
rename from advisories/unreviewed/2025/02/GHSA-8355-xj3p-hv6q/GHSA-8355-xj3p-hv6q.json
rename to advisories/github-reviewed/2025/02/GHSA-8355-xj3p-hv6q/GHSA-8355-xj3p-hv6q.json
index 3ec4aba51bb..c46c8b8536a 100644
--- a/advisories/unreviewed/2025/02/GHSA-8355-xj3p-hv6q/GHSA-8355-xj3p-hv6q.json
+++ b/advisories/github-reviewed/2025/02/GHSA-8355-xj3p-hv6q/GHSA-8355-xj3p-hv6q.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8355-xj3p-hv6q",
-  "modified": "2025-02-14T12:31:38Z",
+  "modified": "2025-02-14T18:06:46Z",
   "published": "2025-02-14T12:31:38Z",
   "aliases": [
     "CVE-2024-52577"
   ],
+  "summary": "Apache Ignite: Possible RCE when deserializing incoming messages by the server node",
   "details": "In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.",
   "severity": [
     {
@@ -13,12 +14,40 @@
       "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.apache.ignite:ignite-core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.6.0"
+            },
+            {
+              "fixed": "2.17.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52577"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/apache/ignite/commit/f1d3579eabb2c6f5b11b94d58600afc497a8603d"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/ignite"
+    },
     {
       "type": "WEB",
       "url": "https://lists.apache.org/thread/1bst0n27m9kb3b6f6hvlghn182vqb2hh"
@@ -29,8 +58,8 @@
       "CWE-502"
     ],
     "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-14T18:06:46Z",
     "nvd_published_at": "2025-02-14T10:15:09Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/02/GHSA-vhxf-7vqr-mrjg/GHSA-vhxf-7vqr-mrjg.json b/advisories/github-reviewed/2025/02/GHSA-vhxf-7vqr-mrjg/GHSA-vhxf-7vqr-mrjg.json
similarity index 64%
rename from advisories/unreviewed/2025/02/GHSA-vhxf-7vqr-mrjg/GHSA-vhxf-7vqr-mrjg.json
rename to advisories/github-reviewed/2025/02/GHSA-vhxf-7vqr-mrjg/GHSA-vhxf-7vqr-mrjg.json
index c4feaaa4b74..f651a1c894e 100644
--- a/advisories/unreviewed/2025/02/GHSA-vhxf-7vqr-mrjg/GHSA-vhxf-7vqr-mrjg.json
+++ b/advisories/github-reviewed/2025/02/GHSA-vhxf-7vqr-mrjg/GHSA-vhxf-7vqr-mrjg.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vhxf-7vqr-mrjg",
-  "modified": "2025-02-14T09:31:22Z",
+  "modified": "2025-02-14T18:05:08Z",
   "published": "2025-02-14T09:31:22Z",
   "aliases": [
     "CVE-2025-26791"
   ],
+  "summary": "DOMPurify allows Cross-site Scripting (XSS)",
   "details": "DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).",
   "severity": [
     {
@@ -13,7 +14,27 @@
       "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "dompurify"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.2.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -27,6 +48,10 @@
       "type": "WEB",
       "url": "https://ensy.zip/posts/dompurify-323-bypass"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/cure53/DOMPurify"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/cure53/DOMPurify/releases/tag/3.2.4"
@@ -41,8 +66,8 @@
       "CWE-79"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-14T18:05:08Z",
     "nvd_published_at": "2025-02-14T09:15:08Z"
   }
 }
\ No newline at end of file