diff --git a/advisories/unreviewed/2022/05/GHSA-g2hf-g7fh-vg92/GHSA-g2hf-g7fh-vg92.json b/advisories/github-reviewed/2022/05/GHSA-g2hf-g7fh-vg92/GHSA-g2hf-g7fh-vg92.json similarity index 54% rename from advisories/unreviewed/2022/05/GHSA-g2hf-g7fh-vg92/GHSA-g2hf-g7fh-vg92.json rename to advisories/github-reviewed/2022/05/GHSA-g2hf-g7fh-vg92/GHSA-g2hf-g7fh-vg92.json index 813cd0647d5..e55afd8aa5d 100644 --- a/advisories/unreviewed/2022/05/GHSA-g2hf-g7fh-vg92/GHSA-g2hf-g7fh-vg92.json +++ b/advisories/github-reviewed/2022/05/GHSA-g2hf-g7fh-vg92/GHSA-g2hf-g7fh-vg92.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-g2hf-g7fh-vg92", - "modified": "2025-04-20T03:44:56Z", + "modified": "2025-04-22T22:15:48Z", "published": "2022-05-17T00:50:35Z", "aliases": [ "CVE-2016-8737" ], + "summary": "Apache Brooklyn is vulnerable to cross-site request forgery (CSRF)", "details": "In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the attacker's commands as the user. There is known to be a proof-of-concept exploit using this vulnerability.", "severity": [ { @@ -13,12 +14,59 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.brooklyn:brooklyn-rest-resources" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.10.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.brooklyn:brooklyn-jsgui" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.10.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8737" }, + { + "type": "WEB", + "url": "https://github.com/apache/brooklyn-server/pull/430" + }, + { + "type": "WEB", + "url": "https://github.com/apache/brooklyn-ui/pull/37" + }, { "type": "WEB", "url": "https://brooklyn.apache.org/community/security/CVE-2016-8737.html" @@ -26,14 +74,6 @@ { "type": "WEB", "url": "https://lists.apache.org/thread.html/877813aaaa0e636adbc36106b89a54e0e6918f0884e9c8b67d5d5953%40%3Cdev.brooklyn.apache.org%3E" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread.html/877813aaaa0e636adbc36106b89a54e0e6918f0884e9c8b67d5d5953@%3Cdev.brooklyn.apache.org%3E" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/96228" } ], "database_specific": { @@ -41,8 +81,8 @@ "CWE-352" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T22:15:48Z", "nvd_published_at": "2017-09-13T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-vfmm-jm4v-7frq/GHSA-vfmm-jm4v-7frq.json b/advisories/github-reviewed/2022/05/GHSA-vfmm-jm4v-7frq/GHSA-vfmm-jm4v-7frq.json new file mode 100644 index 00000000000..7995d48d2b6 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-vfmm-jm4v-7frq/GHSA-vfmm-jm4v-7frq.json @@ -0,0 +1,107 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vfmm-jm4v-7frq", + "modified": "2025-04-22T22:16:01Z", + "published": "2022-05-13T01:27:48Z", + "aliases": [ + "CVE-2014-7808" + ], + "summary": "Apache Wicket insecure defaults", + "details": "Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.wicket:wicket-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.13" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.wicket:wicket-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0-beta1" + }, + { + "fixed": "6.19.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.wicket:wicket-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0-M1" + }, + { + "fixed": "7.0.0-M5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7808" + }, + { + "type": "WEB", + "url": "https://github.com/apache/wicket/commit/d2b8848346b8f806e747dca18799d70c37fc893f" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/wicket" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/rqy6lpo5mzco85cbf65r53vdh87gz77b" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20180830051017/https://www.smrrd.de/cve-2014-7808-apache-wicket-csrf-2014.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-326" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T22:16:01Z", + "nvd_published_at": "2017-09-15T20:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-fpx3-h2pc-88vf/GHSA-fpx3-h2pc-88vf.json b/advisories/github-reviewed/2025/04/GHSA-fpx3-h2pc-88vf/GHSA-fpx3-h2pc-88vf.json similarity index 61% rename from advisories/unreviewed/2025/04/GHSA-fpx3-h2pc-88vf/GHSA-fpx3-h2pc-88vf.json rename to advisories/github-reviewed/2025/04/GHSA-fpx3-h2pc-88vf/GHSA-fpx3-h2pc-88vf.json index 6bf450d0a73..cf61dfa2d0f 100644 --- a/advisories/unreviewed/2025/04/GHSA-fpx3-h2pc-88vf/GHSA-fpx3-h2pc-88vf.json +++ b/advisories/github-reviewed/2025/04/GHSA-fpx3-h2pc-88vf/GHSA-fpx3-h2pc-88vf.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fpx3-h2pc-88vf", - "modified": "2025-04-22T21:30:44Z", + "modified": "2025-04-22T22:16:36Z", "published": "2025-04-22T21:30:44Z", "aliases": [ "CVE-2025-26159" ], + "summary": "Laravel Starter Cross Site Scripting (XSS)", "details": "Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field.", "severity": [ { @@ -13,14 +14,34 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "nasirkhan/laravel-starter" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "11.11.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26159" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://github.com/nasirkhan/laravel-starter" }, { @@ -33,8 +54,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T22:16:36Z", "nvd_published_at": "2025-04-22T20:15:28Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-vfmm-jm4v-7frq/GHSA-vfmm-jm4v-7frq.json b/advisories/unreviewed/2022/05/GHSA-vfmm-jm4v-7frq/GHSA-vfmm-jm4v-7frq.json deleted file mode 100644 index 16d051d54d4..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-vfmm-jm4v-7frq/GHSA-vfmm-jm4v-7frq.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-vfmm-jm4v-7frq", - "modified": "2025-04-20T03:45:23Z", - "published": "2022-05-13T01:27:48Z", - "aliases": [ - "CVE-2014-7808" - ], - "details": "Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7808" - }, - { - "type": "WEB", - "url": "https://www.smrrd.de/cve-2014-7808-apache-wicket-csrf-2014.html" - }, - { - "type": "WEB", - "url": "http://mail-archives.apache.org/mod_mbox/wicket-users/201502.mbox/%3CCAMomwMpLPDYezc=iFofm1R1Uq37vUFJ8VC-_ex5SU8-HAKBoRw%40mail.gmail.com%3E" - }, - { - "type": "WEB", - "url": "http://mail-archives.apache.org/mod_mbox/wicket-users/201502.mbox/%3CCAMomwMpLPDYezc=iFofm1R1Uq37vUFJ8VC-_ex5SU8-HAKBoRw@mail.gmail.com%3E" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-09-15T20:29:00Z" - } -} \ No newline at end of file