diff --git a/advisories/unreviewed/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json b/advisories/github-reviewed/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json similarity index 53% rename from advisories/unreviewed/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json rename to advisories/github-reviewed/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json index 2b8444f4541..54ce98327e9 100644 --- a/advisories/unreviewed/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json +++ b/advisories/github-reviewed/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json @@ -1,17 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-544r-fc65-v832", - "modified": "2024-06-14T12:30:50Z", + "modified": "2024-06-17T21:23:04Z", "published": "2024-06-14T12:30:50Z", "aliases": [ "CVE-2024-5685" ], + "summary": "Snipe-IT allows users to promote or demote themselves or other users", "details": "Users with \"User:edit\" and \"Self:api\" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "snipe/snipe-it" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.4.2" + } + ] + } + ] + } ], "references": [ { @@ -26,6 +52,10 @@ "type": "WEB", "url": "https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1" }, + { + "type": "PACKAGE", + "url": "https://github.com/snipe/snipe-it" + }, { "type": "WEB", "url": "https://github.com/snipe/snipe-it/releases/tag/v6.4.2" @@ -35,9 +65,9 @@ "cwe_ids": [ "CWE-862" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-06-17T21:23:04Z", "nvd_published_at": "2024-06-14T10:15:10Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json b/advisories/github-reviewed/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json similarity index 55% rename from advisories/unreviewed/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json rename to advisories/github-reviewed/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json index 30894e944b5..9dfe73fcf34 100644 --- a/advisories/unreviewed/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json +++ b/advisories/github-reviewed/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-hvxg-77mg-vrvp", - "modified": "2024-06-14T09:31:17Z", + "modified": "2024-06-17T21:23:17Z", "published": "2024-06-14T09:31:17Z", "aliases": [ "CVE-2024-37182" ], + "summary": "Mattermost Desktop App Remote Code Execution", "details": "Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim's system via custom URI schemes.", "severity": [ { @@ -14,13 +15,39 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "mattermost-desktop" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.8.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37182" }, + { + "type": "WEB", + "url": "https://github.com/mattermost/desktop/commit/1c9fc719dc2b74495a05f7ebc90e92e7daa03e6d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/desktop" + }, { "type": "WEB", "url": "https://mattermost.com/security-updates" @@ -31,8 +58,8 @@ "CWE-693" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-06-17T21:23:17Z", "nvd_published_at": "2024-06-14T09:15:10Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json b/advisories/github-reviewed/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json similarity index 57% rename from advisories/unreviewed/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json rename to advisories/github-reviewed/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json index 1b3896b02de..f1ae3166af0 100644 --- a/advisories/unreviewed/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json +++ b/advisories/github-reviewed/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-hw2c-8xgw-mf57", - "modified": "2024-06-16T15:30:44Z", + "modified": "2024-06-17T21:22:07Z", "published": "2024-06-16T15:30:44Z", "aliases": [ "CVE-2024-38460" ], + "summary": "SonarQube logs sensitive information", "details": "In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).", "severity": [ { @@ -14,17 +15,43 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.sonarsource.sonarqube:sonar-web" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "9.9.4" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38460" }, + { + "type": "WEB", + "url": "https://github.com/SonarSource/sonarqube/commit/48f43d6a3bf9bbd7c9b58eb5cde635572184ad01" + }, { "type": "WEB", "url": "https://community.sonarsource.com/t/sonarqube-ce-10-3-0-leaking-encrypted-values-in-web-server-logs/108187" }, + { + "type": "PACKAGE", + "url": "https://github.com/SonarSource/sonarqube" + }, { "type": "WEB", "url": "https://sonarsource.atlassian.net/browse/SONAR-21559" @@ -32,11 +59,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-532" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-06-17T21:22:06Z", "nvd_published_at": "2024-06-16T15:15:51Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json b/advisories/github-reviewed/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json similarity index 55% rename from advisories/unreviewed/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json rename to advisories/github-reviewed/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json index bd9dd071e44..56728944c92 100644 --- a/advisories/unreviewed/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json +++ b/advisories/github-reviewed/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-xgqm-wp7w-mgg2", - "modified": "2024-06-14T09:31:17Z", + "modified": "2024-06-17T21:23:49Z", "published": "2024-06-14T09:31:17Z", "aliases": [ "CVE-2024-36287" ], + "summary": "Mattermost Desktop App allows for bypassing TCC restrictions on macOS", "details": "Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "mattermost-desktop" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.8.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36287" }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/desktop" + }, { "type": "WEB", "url": "https://mattermost.com/security-updates" @@ -31,8 +54,8 @@ "CWE-693" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-06-17T21:23:49Z", "nvd_published_at": "2024-06-14T09:15:09Z" } } \ No newline at end of file