diff --git a/advisories/github-reviewed/2024/03/GHSA-p2gx-4434-pf6g/GHSA-p2gx-4434-pf6g.json b/advisories/github-reviewed/2024/03/GHSA-p2gx-4434-pf6g/GHSA-p2gx-4434-pf6g.json index dc8b24fdfcf..40bd12de8cc 100644 --- a/advisories/github-reviewed/2024/03/GHSA-p2gx-4434-pf6g/GHSA-p2gx-4434-pf6g.json +++ b/advisories/github-reviewed/2024/03/GHSA-p2gx-4434-pf6g/GHSA-p2gx-4434-pf6g.json @@ -1,15 +1,22 @@ { "schema_version": "1.4.0", "id": "GHSA-p2gx-4434-pf6g", - "modified": "2024-05-02T14:45:04Z", + "modified": "2024-08-02T13:58:22Z", "published": "2024-03-06T12:30:29Z", "aliases": [ "CVE-2024-26580" ], "summary": "Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability", - "details": "Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can \n\nuse the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick [1] to solve it.\n\n[1] https://github.com/apache/inlong/pull/9673 \n\n", + "details": "Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can \n\nuse the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick [1] to solve it.\n\n[1] https://github.com/apache/inlong/pull/9673", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -62,7 +69,7 @@ "cwe_ids": [ "CWE-502" ], - "severity": "HIGH", + "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2024-03-06T17:05:57Z", "nvd_published_at": "2024-03-06T12:15:45Z" diff --git a/advisories/github-reviewed/2024/03/GHSA-w5mx-334j-6fwv/GHSA-w5mx-334j-6fwv.json b/advisories/github-reviewed/2024/03/GHSA-w5mx-334j-6fwv/GHSA-w5mx-334j-6fwv.json index f8c656b5b60..250664c36ea 100644 --- a/advisories/github-reviewed/2024/03/GHSA-w5mx-334j-6fwv/GHSA-w5mx-334j-6fwv.json +++ b/advisories/github-reviewed/2024/03/GHSA-w5mx-334j-6fwv/GHSA-w5mx-334j-6fwv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-w5mx-334j-6fwv", - "modified": "2024-03-01T20:08:03Z", + "modified": "2024-08-02T13:57:25Z", "published": "2024-03-01T18:30:23Z", "aliases": [ "CVE-2024-27499" @@ -9,7 +9,14 @@ "summary": "Bagist Cross-site Scripting vulnerability", "details": "Bagisto is vulnerable to cross-site scripting (XSS) via png file upload vulnerability in product review option.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L" + } ], "affected": [ {