Publish Advisories

GHSA-p2gx-4434-pf6g
GHSA-w5mx-334j-6fwv

advisories/github-reviewed/2024/03/GHSA-p2gx-4434-pf6g/GHSA-p2gx-4434-pf6g.json

@@ -1,15 +1,22 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-p2gx-4434-pf6g",
-  "modified": "2024-05-02T14:45:04Z",
+  "modified": "2024-08-02T13:58:22Z",
   "published": "2024-03-06T12:30:29Z",
   "aliases": [
     "CVE-2024-26580"
   ],
   "summary": "Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability",
-  "details": "Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can \n\nuse the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/9673 \n\n",
+  "details": "Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can \n\nuse the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/9673",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -62,7 +69,7 @@
     "cwe_ids": [
       "CWE-502"
     ],
-    "severity": "HIGH",
+    "severity": "CRITICAL",
     "github_reviewed": true,
     "github_reviewed_at": "2024-03-06T17:05:57Z",
     "nvd_published_at": "2024-03-06T12:15:45Z"

advisories/github-reviewed/2024/03/GHSA-w5mx-334j-6fwv/GHSA-w5mx-334j-6fwv.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-w5mx-334j-6fwv",
-  "modified": "2024-03-01T20:08:03Z",
+  "modified": "2024-08-02T13:57:25Z",
   "published": "2024-03-01T18:30:23Z",
   "aliases": [
     "CVE-2024-27499"
@@ -9,7 +9,14 @@
   "summary": "Bagist Cross-site Scripting vulnerability",
   "details": "Bagisto is vulnerable to cross-site scripting (XSS) via png file upload vulnerability in product review option.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L"
+    }
   ],
   "affected": [
     {