From 48f0355384cefca9a024f031199ab87c83a5fed1 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 14 Oct 2024 21:37:13 +0000
Subject: [PATCH] Publish Advisories

GHSA-hjfx-8p6c-g7gx
GHSA-3v28-9jjp-4g5w
GHSA-pwpq-632g-h49g
---
 .../GHSA-hjfx-8p6c-g7gx.json                  | 14 ++++++++++++-
 .../GHSA-3v28-9jjp-4g5w.json                  | 21 ++++++++++++++++---
 .../GHSA-pwpq-632g-h49g.json                  | 15 +++++++++++--
 3 files changed, 44 insertions(+), 6 deletions(-)

diff --git a/advisories/github-reviewed/2021/06/GHSA-hjfx-8p6c-g7gx/GHSA-hjfx-8p6c-g7gx.json b/advisories/github-reviewed/2021/06/GHSA-hjfx-8p6c-g7gx/GHSA-hjfx-8p6c-g7gx.json
index 880255eee1e..26eb13c9e30 100644
--- a/advisories/github-reviewed/2021/06/GHSA-hjfx-8p6c-g7gx/GHSA-hjfx-8p6c-g7gx.json
+++ b/advisories/github-reviewed/2021/06/GHSA-hjfx-8p6c-g7gx/GHSA-hjfx-8p6c-g7gx.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hjfx-8p6c-g7gx",
-  "modified": "2023-09-04T16:28:23Z",
+  "modified": "2024-10-14T21:36:39Z",
   "published": "2021-06-08T18:49:20Z",
   "aliases": [
     "CVE-2021-28678"
@@ -12,6 +12,10 @@
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [
@@ -48,6 +52,14 @@
       "type": "WEB",
       "url": "https://github.com/python-pillow/Pillow/pull/5377/commits/496245aa4365d0827390bd0b6fbd11287453b3a1"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/advisories/GHSA-hjfx-8p6c-g7gx"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-94.yaml"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/python-pillow/Pillow"
diff --git a/advisories/github-reviewed/2022/05/GHSA-3v28-9jjp-4g5w/GHSA-3v28-9jjp-4g5w.json b/advisories/github-reviewed/2022/05/GHSA-3v28-9jjp-4g5w/GHSA-3v28-9jjp-4g5w.json
index a72c91fc0c1..01fd7afb29a 100644
--- a/advisories/github-reviewed/2022/05/GHSA-3v28-9jjp-4g5w/GHSA-3v28-9jjp-4g5w.json
+++ b/advisories/github-reviewed/2022/05/GHSA-3v28-9jjp-4g5w/GHSA-3v28-9jjp-4g5w.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3v28-9jjp-4g5w",
-  "modified": "2024-05-01T10:51:17Z",
+  "modified": "2024-10-14T21:34:28Z",
   "published": "2022-05-17T02:01:56Z",
   "aliases": [
     "CVE-2011-0720"
@@ -9,7 +9,14 @@
   "summary": "Plone Privilege Escalation Vulnerability",
   "details": "Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -45,6 +52,10 @@
       "type": "PACKAGE",
       "url": "https://github.com/plone/Plone"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2011-13.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://plone.org/products/plone-hotfix/releases/CVE-2011-0720/logchecker.py"
@@ -65,6 +76,10 @@
       "type": "WEB",
       "url": "https://web.archive.org/web/20200229153953/http://www.securityfocus.com/bid/46102"
     },
+    {
+      "type": "WEB",
+      "url": "http://osvdb.org/70753"
+    },
     {
       "type": "WEB",
       "url": "http://plone.org/products/plone/security/advisories/cve-2011-0720"
@@ -82,7 +97,7 @@
     "cwe_ids": [
 
     ],
-    "severity": "HIGH",
+    "severity": "CRITICAL",
     "github_reviewed": true,
     "github_reviewed_at": "2024-05-01T10:51:17Z",
     "nvd_published_at": "2011-02-03T17:00:00Z"
diff --git a/advisories/github-reviewed/2022/05/GHSA-pwpq-632g-h49g/GHSA-pwpq-632g-h49g.json b/advisories/github-reviewed/2022/05/GHSA-pwpq-632g-h49g/GHSA-pwpq-632g-h49g.json
index d8e80f59900..bcc22428b94 100644
--- a/advisories/github-reviewed/2022/05/GHSA-pwpq-632g-h49g/GHSA-pwpq-632g-h49g.json
+++ b/advisories/github-reviewed/2022/05/GHSA-pwpq-632g-h49g/GHSA-pwpq-632g-h49g.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-pwpq-632g-h49g",
-  "modified": "2024-04-29T16:41:53Z",
+  "modified": "2024-10-14T21:36:03Z",
   "published": "2022-05-17T04:49:49Z",
   "aliases": [
     "CVE-2013-4189"
@@ -9,7 +9,14 @@
   "summary": "Plone Privilege escalation due improper authorization",
   "details": "Multiple unspecified vulnerabilities in (1) `dataitems.py`, (2) `get.py`, and (3) `traverseName.py` in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -83,6 +90,10 @@
       "type": "PACKAGE",
       "url": "https://github.com/plone/Plone"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-53.yaml"
+    },
     {
       "type": "WEB",
       "url": "http://plone.org/products/plone-hotfix/releases/20130618"