diff --git a/advisories/unreviewed/2022/05/GHSA-2cf3-g243-hhfx/GHSA-2cf3-g243-hhfx.json b/advisories/github-reviewed/2022/05/GHSA-2cf3-g243-hhfx/GHSA-2cf3-g243-hhfx.json similarity index 69% rename from advisories/unreviewed/2022/05/GHSA-2cf3-g243-hhfx/GHSA-2cf3-g243-hhfx.json rename to advisories/github-reviewed/2022/05/GHSA-2cf3-g243-hhfx/GHSA-2cf3-g243-hhfx.json index 5014df65b1a..c44395d5de9 100644 --- a/advisories/unreviewed/2022/05/GHSA-2cf3-g243-hhfx/GHSA-2cf3-g243-hhfx.json +++ b/advisories/github-reviewed/2022/05/GHSA-2cf3-g243-hhfx/GHSA-2cf3-g243-hhfx.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-2cf3-g243-hhfx", - "modified": "2022-05-13T01:45:43Z", + "modified": "2024-04-22T22:58:16Z", "published": "2022-05-13T01:45:43Z", "aliases": [ "CVE-2017-3590" ], + "summary": "MySQL Connectors Privilege Escalation", "details": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 2.1.5 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mysql-connector-python" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.1.5" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3590" }, + { + "type": "PACKAGE", + "url": "https://github.com/mysql/mysql-connector-python" + }, { "type": "WEB", "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html" @@ -39,8 +62,8 @@ ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:58:16Z", "nvd_published_at": "2017-04-24T19:59:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-7cwg-2575-3546/GHSA-7cwg-2575-3546.json b/advisories/github-reviewed/2022/05/GHSA-7cwg-2575-3546/GHSA-7cwg-2575-3546.json new file mode 100644 index 00000000000..dc65f32badc --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-7cwg-2575-3546/GHSA-7cwg-2575-3546.json @@ -0,0 +1,194 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7cwg-2575-3546", + "modified": "2024-04-22T22:57:56Z", + "published": "2022-05-13T01:39:57Z", + "aliases": [ + "CVE-2017-0360" + ], + "summary": "Tryton Information Disclosure Vulnerability", + "details": "file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a \"same root name but with a suffix\" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "trytond" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "last_affected": "3.0.17" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "trytond" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2.0" + }, + { + "last_affected": "3.2.17" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "trytond" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4.0" + }, + { + "last_affected": "3.4.17" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "trytond" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.6.0" + }, + { + "last_affected": "3.6.16" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "trytond" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.8.0" + }, + { + "last_affected": "3.8.14" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "trytond" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "last_affected": "4.0.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "trytond" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.4.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.2.2" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0360" + }, + { + "type": "WEB", + "url": "https://github.com/tryton/trytond/commit/30e978593733385db3144f8c583eeb4679575cf0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/tryton/trytond" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-security-announce/2017/msg00084.html" + }, + { + "type": "WEB", + "url": "http://hg.tryton.org/trytond?cmd=changeset;node=472510fdc6f8" + }, + { + "type": "WEB", + "url": "http://www.debian.org/security/2017/dsa-3826" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/97489" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:57:56Z", + "nvd_published_at": "2017-04-04T17:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-mv8g-fhh6-6267/GHSA-mv8g-fhh6-6267.json b/advisories/github-reviewed/2022/05/GHSA-mv8g-fhh6-6267/GHSA-mv8g-fhh6-6267.json similarity index 57% rename from advisories/unreviewed/2022/05/GHSA-mv8g-fhh6-6267/GHSA-mv8g-fhh6-6267.json rename to advisories/github-reviewed/2022/05/GHSA-mv8g-fhh6-6267/GHSA-mv8g-fhh6-6267.json index 4f0dfd03a0d..b4c64da33e4 100644 --- a/advisories/unreviewed/2022/05/GHSA-mv8g-fhh6-6267/GHSA-mv8g-fhh6-6267.json +++ b/advisories/github-reviewed/2022/05/GHSA-mv8g-fhh6-6267/GHSA-mv8g-fhh6-6267.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-mv8g-fhh6-6267", - "modified": "2022-05-17T00:27:18Z", + "modified": "2024-04-22T22:58:32Z", "published": "2022-05-17T00:27:18Z", "aliases": [ "CVE-2016-9013" ], + "summary": "Django user with hardcoded password created when running tests on Oracle", "details": "Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.", "severity": [ { @@ -14,13 +15,73 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "django" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.10" + }, + { + "fixed": "1.10.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "django" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.9" + }, + { + "fixed": "1.9.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "django" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.8" + }, + { + "fixed": "1.8.16" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9013" }, + { + "type": "PACKAGE", + "url": "https://github.com/django/django" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ" @@ -55,8 +116,8 @@ "CWE-798" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:58:32Z", "nvd_published_at": "2016-12-09T20:59:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-qxm5-vx5j-pp6w/GHSA-qxm5-vx5j-pp6w.json b/advisories/github-reviewed/2022/05/GHSA-qxm5-vx5j-pp6w/GHSA-qxm5-vx5j-pp6w.json new file mode 100644 index 00000000000..b6a6562e09e --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-qxm5-vx5j-pp6w/GHSA-qxm5-vx5j-pp6w.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qxm5-vx5j-pp6w", + "modified": "2024-04-22T22:57:14Z", + "published": "2022-05-24T17:35:23Z", + "aliases": [ + "CVE-2020-27348" + ], + "summary": "snapcraft Access Restriction Bypass", + "details": "In some conditions, a snap package built by snapcraft includes the current directory in `LD_LIBRARY_PATH`, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "snapcraft" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.4.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27348" + }, + { + "type": "WEB", + "url": "https://github.com/snapcore/snapcraft/pull/3345" + }, + { + "type": "WEB", + "url": "https://github.com/snapcore/snapcraft/commit/a0ceca9d531a34c979251030ed67b5fa2abfdd9a" + }, + { + "type": "WEB", + "url": "https://bugs.launchpad.net/bugs/1901572" + }, + { + "type": "PACKAGE", + "url": "https://github.com/snapcore/snapcraft" + }, + { + "type": "WEB", + "url": "https://usn.ubuntu.com/usn/usn-4661-1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:57:14Z", + "nvd_published_at": "2020-12-04T03:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-whmq-cfm5-j8mj/GHSA-whmq-cfm5-j8mj.json b/advisories/github-reviewed/2022/05/GHSA-whmq-cfm5-j8mj/GHSA-whmq-cfm5-j8mj.json similarity index 61% rename from advisories/unreviewed/2022/05/GHSA-whmq-cfm5-j8mj/GHSA-whmq-cfm5-j8mj.json rename to advisories/github-reviewed/2022/05/GHSA-whmq-cfm5-j8mj/GHSA-whmq-cfm5-j8mj.json index 8336d8d11d0..cdd91aedfcd 100644 --- a/advisories/unreviewed/2022/05/GHSA-whmq-cfm5-j8mj/GHSA-whmq-cfm5-j8mj.json +++ b/advisories/github-reviewed/2022/05/GHSA-whmq-cfm5-j8mj/GHSA-whmq-cfm5-j8mj.json @@ -1,17 +1,29 @@ { "schema_version": "1.4.0", "id": "GHSA-whmq-cfm5-j8mj", - "modified": "2022-05-24T17:42:18Z", + "modified": "2024-04-22T22:57:23Z", "published": "2022-05-24T17:42:18Z", "aliases": [ "CVE-2020-25340" ], + "summary": "NFStream Local Denial of Service (DoS)", "details": "An issue was discovered in NFStream 5.2.0. Because some allocated modules are not correctly freed, if the nfstream object is directly destroyed without being used after it is created, it will cause a memory leak that may result in a local denial of service (DoS).", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "nfstream" + }, + "versions": [ + "5.2.0" + ] + } ], "references": [ { @@ -21,15 +33,20 @@ { "type": "WEB", "url": "https://github.com/ntop/nDPI/issues/994" + }, + { + "type": "PACKAGE", + "url": "https://github.com/nfstream/nfstream" } ], "database_specific": { "cwe_ids": [ + "CWE-401", "CWE-770" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:57:23Z", "nvd_published_at": "2021-02-16T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-7cwg-2575-3546/GHSA-7cwg-2575-3546.json b/advisories/unreviewed/2022/05/GHSA-7cwg-2575-3546/GHSA-7cwg-2575-3546.json deleted file mode 100644 index f2f8e345433..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-7cwg-2575-3546/GHSA-7cwg-2575-3546.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-7cwg-2575-3546", - "modified": "2022-05-13T01:39:57Z", - "published": "2022-05-13T01:39:57Z", - "aliases": [ - "CVE-2017-0360" - ], - "details": "file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a \"same root name but with a suffix\" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0360" - }, - { - "type": "WEB", - "url": "https://lists.debian.org/debian-security-announce/2017/msg00084.html" - }, - { - "type": "WEB", - "url": "http://hg.tryton.org/trytond?cmd=changeset;node=472510fdc6f8" - }, - { - "type": "WEB", - "url": "http://www.debian.org/security/2017/dsa-3826" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/97489" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-269" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-04-04T17:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-qxm5-vx5j-pp6w/GHSA-qxm5-vx5j-pp6w.json b/advisories/unreviewed/2022/05/GHSA-qxm5-vx5j-pp6w/GHSA-qxm5-vx5j-pp6w.json deleted file mode 100644 index 547cb614bdf..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-qxm5-vx5j-pp6w/GHSA-qxm5-vx5j-pp6w.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-qxm5-vx5j-pp6w", - "modified": "2022-05-24T17:35:23Z", - "published": "2022-05-24T17:35:23Z", - "aliases": [ - "CVE-2020-27348" - ], - "details": "In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27348" - }, - { - "type": "WEB", - "url": "https://github.com/snapcore/snapcraft/pull/3345" - }, - { - "type": "WEB", - "url": "https://bugs.launchpad.net/bugs/1901572" - }, - { - "type": "WEB", - "url": "https://usn.ubuntu.com/usn/usn-4661-1" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-427" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-12-04T03:15:00Z" - } -} \ No newline at end of file