diff --git a/advisories/unreviewed/2022/03/GHSA-2c7w-v459-cwgf/GHSA-2c7w-v459-cwgf.json b/advisories/github-reviewed/2022/03/GHSA-2c7w-v459-cwgf/GHSA-2c7w-v459-cwgf.json similarity index 51% rename from advisories/unreviewed/2022/03/GHSA-2c7w-v459-cwgf/GHSA-2c7w-v459-cwgf.json rename to advisories/github-reviewed/2022/03/GHSA-2c7w-v459-cwgf/GHSA-2c7w-v459-cwgf.json index 0a93404495d..3c25a6b50ca 100644 --- a/advisories/unreviewed/2022/03/GHSA-2c7w-v459-cwgf/GHSA-2c7w-v459-cwgf.json +++ b/advisories/github-reviewed/2022/03/GHSA-2c7w-v459-cwgf/GHSA-2c7w-v459-cwgf.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-2c7w-v459-cwgf", - "modified": "2022-04-01T00:00:55Z", + "modified": "2024-11-22T20:20:55Z", "published": "2022-03-25T00:00:33Z", "aliases": [ "CVE-2022-25568" ], + "summary": "MotionEye allows attackers to access sensitive information", "details": "MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "motioneye" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.43.1b1" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,18 @@ "type": "WEB", "url": "https://github.com/ccrisan/motioneye/issues/2292" }, + { + "type": "WEB", + "url": "https://github.com/motioneye-project/motioneye/commit/c60b64af5bb8c09189071522a1f6796cb44340b0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/motioneye-project/motioneye" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/motioneye/PYSEC-2022-43141.yaml" + }, { "type": "WEB", "url": "https://www.pizzapower.me/2022/02/17/motioneye-config-info-disclosure" @@ -35,8 +66,8 @@ "CWE-200" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T20:20:55Z", "nvd_published_at": "2022-03-24T17:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/04/GHSA-98j2-hfxp-8h8r/GHSA-98j2-hfxp-8h8r.json b/advisories/github-reviewed/2022/04/GHSA-98j2-hfxp-8h8r/GHSA-98j2-hfxp-8h8r.json similarity index 59% rename from advisories/unreviewed/2022/04/GHSA-98j2-hfxp-8h8r/GHSA-98j2-hfxp-8h8r.json rename to advisories/github-reviewed/2022/04/GHSA-98j2-hfxp-8h8r/GHSA-98j2-hfxp-8h8r.json index 9322a872f85..f702adbf0d4 100644 --- a/advisories/unreviewed/2022/04/GHSA-98j2-hfxp-8h8r/GHSA-98j2-hfxp-8h8r.json +++ b/advisories/github-reviewed/2022/04/GHSA-98j2-hfxp-8h8r/GHSA-98j2-hfxp-8h8r.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-98j2-hfxp-8h8r", - "modified": "2022-05-07T00:01:11Z", + "modified": "2024-11-22T20:22:34Z", "published": "2022-04-27T00:00:20Z", "aliases": [ "CVE-2022-23942" ], + "summary": "Apache Doris hardcoded key and IV", "details": "Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.", "severity": [ { @@ -14,13 +15,39 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "pydoris" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23942" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/doris" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pydoris/PYSEC-2022-43150.yaml" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/com2dyzp3bn2rdrotry90q2zzord4tvt" @@ -39,8 +66,8 @@ "CWE-798" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T20:22:34Z", "nvd_published_at": "2022-04-26T16:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/04/GHSA-h2rr-m97p-6jq9/GHSA-h2rr-m97p-6jq9.json b/advisories/github-reviewed/2022/04/GHSA-h2rr-m97p-6jq9/GHSA-h2rr-m97p-6jq9.json new file mode 100644 index 00000000000..c4cbc93f553 --- /dev/null +++ b/advisories/github-reviewed/2022/04/GHSA-h2rr-m97p-6jq9/GHSA-h2rr-m97p-6jq9.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h2rr-m97p-6jq9", + "modified": "2024-11-22T20:22:09Z", + "published": "2022-04-20T00:00:34Z", + "aliases": [ + "CVE-2022-28108" + ], + "summary": "Selenium Server (Grid) CSRF", + "details": "Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.seleniumhq.selenium:selenium-grid" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.0.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.seleniumhq.selenium:selenium-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.0.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28108" + }, + { + "type": "PACKAGE", + "url": "https://github.com/SeleniumHQ/selenium" + }, + { + "type": "WEB", + "url": "https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce" + }, + { + "type": "WEB", + "url": "https://www.openwall.com/lists/oss-security/2022/02/07/3" + }, + { + "type": "WEB", + "url": "https://www.openwall.com/lists/oss-security/2022/04/14/2" + }, + { + "type": "WEB", + "url": "https://www.selenium.dev/downloads" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T20:22:09Z", + "nvd_published_at": "2022-04-19T03:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-wpvx-26f7-65q3/GHSA-wpvx-26f7-65q3.json b/advisories/github-reviewed/2022/05/GHSA-wpvx-26f7-65q3/GHSA-wpvx-26f7-65q3.json similarity index 65% rename from advisories/unreviewed/2022/05/GHSA-wpvx-26f7-65q3/GHSA-wpvx-26f7-65q3.json rename to advisories/github-reviewed/2022/05/GHSA-wpvx-26f7-65q3/GHSA-wpvx-26f7-65q3.json index 1c0a4ec297a..f3fecbd5272 100644 --- a/advisories/unreviewed/2022/05/GHSA-wpvx-26f7-65q3/GHSA-wpvx-26f7-65q3.json +++ b/advisories/github-reviewed/2022/05/GHSA-wpvx-26f7-65q3/GHSA-wpvx-26f7-65q3.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-wpvx-26f7-65q3", - "modified": "2022-05-17T04:41:54Z", + "modified": "2024-11-22T20:21:10Z", "published": "2022-05-17T04:41:54Z", "aliases": [ "CVE-2014-3840" ], + "summary": "Mayan EDMS multiple cross-site scripting (XSS) vulnerabilities", "details": "Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a (1) tag or the (2) title of a source in a Staging folder, (3) Name field in a bootstrap setup, or Title field in a (4) smart link or (5) web form.", "severity": [ - + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mayan-edms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ] + } ], "references": [ { @@ -26,6 +45,14 @@ "type": "WEB", "url": "https://github.com/mayan-edms/mayan-edms/commit/398c480c10416d76e7c1dcb607e726e8fc988e72" }, + { + "type": "PACKAGE", + "url": "https://github.com/mayan-edms/Mayan-EDMS" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mayan-edms/PYSEC-2014-110.yaml" + }, { "type": "WEB", "url": "http://research.openflare.org/advisories/OF-2014-09/mayan-edbs-storedxss.txt" @@ -45,19 +72,15 @@ { "type": "WEB", "url": "http://www.exploit-db.com/exploits/33493" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/67552" } ], "database_specific": { "cwe_ids": [ "CWE-79" ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T20:21:10Z", "nvd_published_at": "2014-05-27T13:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/02/GHSA-5m6v-2xgf-qhrw/GHSA-5m6v-2xgf-qhrw.json b/advisories/github-reviewed/2023/02/GHSA-5m6v-2xgf-qhrw/GHSA-5m6v-2xgf-qhrw.json similarity index 56% rename from advisories/unreviewed/2023/02/GHSA-5m6v-2xgf-qhrw/GHSA-5m6v-2xgf-qhrw.json rename to advisories/github-reviewed/2023/02/GHSA-5m6v-2xgf-qhrw/GHSA-5m6v-2xgf-qhrw.json index c81d81a269a..65d2adf13b2 100644 --- a/advisories/unreviewed/2023/02/GHSA-5m6v-2xgf-qhrw/GHSA-5m6v-2xgf-qhrw.json +++ b/advisories/github-reviewed/2023/02/GHSA-5m6v-2xgf-qhrw/GHSA-5m6v-2xgf-qhrw.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-5m6v-2xgf-qhrw", - "modified": "2023-02-15T21:30:30Z", + "modified": "2024-11-22T20:21:19Z", "published": "2023-02-08T00:30:34Z", "aliases": [ "CVE-2022-47419" ], + "summary": "Mayan EDMS DMS XSS vulnerability", "details": "An XSS vulnerability was discovered in the Mayan EDMS DMS. Successful XSS exploitation was observed in the in-product tagging system.", "severity": [ { @@ -14,13 +15,39 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mayan-edms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.3.6" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47419" }, + { + "type": "PACKAGE", + "url": "https://github.com/mayan-edms/Mayan-EDMS" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mayan-edms/PYSEC-2023-276.yaml" + }, { "type": "WEB", "url": "https://www.mayan-edms.com/news/2023/02/version-4.3.6" @@ -35,8 +62,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T20:21:19Z", "nvd_published_at": "2023-02-07T22:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/12/GHSA-9w2p-rh8c-v9g5/GHSA-9w2p-rh8c-v9g5.json b/advisories/github-reviewed/2023/12/GHSA-9w2p-rh8c-v9g5/GHSA-9w2p-rh8c-v9g5.json index 7537d83a7bf..80af27d0baa 100644 --- a/advisories/github-reviewed/2023/12/GHSA-9w2p-rh8c-v9g5/GHSA-9w2p-rh8c-v9g5.json +++ b/advisories/github-reviewed/2023/12/GHSA-9w2p-rh8c-v9g5/GHSA-9w2p-rh8c-v9g5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9w2p-rh8c-v9g5", - "modified": "2023-12-11T17:51:02Z", + "modified": "2024-11-22T20:21:21Z", "published": "2023-12-09T00:39:46Z", "aliases": [ "CVE-2023-49797" @@ -52,6 +52,10 @@ "type": "PACKAGE", "url": "https://github.com/pyinstaller/pyinstaller" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyinstaller/PYSEC-2023-292.yaml" + }, { "type": "WEB", "url": "https://github.com/python/cpython/blob/0fb18b02c8ad56299d6a2910be0bab8ad601ef24/Lib/shutil.py#L623" diff --git a/advisories/github-reviewed/2023/12/GHSA-v5f6-hjmf-9mc5/GHSA-v5f6-hjmf-9mc5.json b/advisories/github-reviewed/2023/12/GHSA-v5f6-hjmf-9mc5/GHSA-v5f6-hjmf-9mc5.json index 19c9fb048f9..1b57205648b 100644 --- a/advisories/github-reviewed/2023/12/GHSA-v5f6-hjmf-9mc5/GHSA-v5f6-hjmf-9mc5.json +++ b/advisories/github-reviewed/2023/12/GHSA-v5f6-hjmf-9mc5/GHSA-v5f6-hjmf-9mc5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-v5f6-hjmf-9mc5", - "modified": "2023-12-05T23:43:07Z", + "modified": "2024-11-22T20:20:57Z", "published": "2023-12-05T23:43:07Z", "aliases": [ "CVE-2023-49297" @@ -61,6 +61,10 @@ "type": "PACKAGE", "url": "https://github.com/iterative/PyDrive2" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pydrive2/PYSEC-2023-291.yaml" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYR5SJKOFSSXFV3E3D2SLXBUBA5WMJJG" diff --git a/advisories/unreviewed/2022/04/GHSA-h2rr-m97p-6jq9/GHSA-h2rr-m97p-6jq9.json b/advisories/unreviewed/2022/04/GHSA-h2rr-m97p-6jq9/GHSA-h2rr-m97p-6jq9.json deleted file mode 100644 index f464eae7ab5..00000000000 --- a/advisories/unreviewed/2022/04/GHSA-h2rr-m97p-6jq9/GHSA-h2rr-m97p-6jq9.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-h2rr-m97p-6jq9", - "modified": "2022-04-28T00:00:48Z", - "published": "2022-04-20T00:00:34Z", - "aliases": [ - "CVE-2022-28108" - ], - "details": "Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28108" - }, - { - "type": "WEB", - "url": "https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce" - }, - { - "type": "WEB", - "url": "https://www.openwall.com/lists/oss-security/2022/02/07/3" - }, - { - "type": "WEB", - "url": "https://www.selenium.dev/downloads" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-04-19T03:15:00Z" - } -} \ No newline at end of file