diff --git a/advisories/github-reviewed/2022/05/GHSA-3gx6-h57h-rm27/GHSA-3gx6-h57h-rm27.json b/advisories/github-reviewed/2022/05/GHSA-3gx6-h57h-rm27/GHSA-3gx6-h57h-rm27.json new file mode 100644 index 00000000000..23b8d0bb483 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-3gx6-h57h-rm27/GHSA-3gx6-h57h-rm27.json @@ -0,0 +1,184 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3gx6-h57h-rm27", + "modified": "2024-04-23T17:19:43Z", + "published": "2022-05-13T01:22:41Z", + "aliases": [ + "CVE-2019-6340" + ], + "summary": "Drupal Core Remote Code Execution Vulnerability", + "details": "Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.6.0" + }, + { + "fixed": "8.6.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "7.62.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.5.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "7.62.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.5.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.6.0" + }, + { + "fixed": "8.6.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6340" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6340.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6340.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/drupal" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2019-003" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/46452" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/46459" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/46510" + }, + { + "type": "WEB", + "url": "https://www.synology.com/security/advisory/Synology_SA_19_09" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/107106" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:19:43Z", + "nvd_published_at": "2019-02-21T21:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-h377-287m-w2r9/GHSA-h377-287m-w2r9.json b/advisories/github-reviewed/2022/05/GHSA-h377-287m-w2r9/GHSA-h377-287m-w2r9.json new file mode 100644 index 00000000000..19c7cccf0f3 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-h377-287m-w2r9/GHSA-h377-287m-w2r9.json @@ -0,0 +1,100 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h377-287m-w2r9", + "modified": "2024-04-23T17:20:19Z", + "published": "2022-05-13T01:36:23Z", + "aliases": [ + "CVE-2017-6921" + ], + "summary": "Drupal file REST resource does not properly validate", + "details": "In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.3.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.3.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6921" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6921.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6921.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/SA-CORE-2017-003" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/99222" + }, + { + "type": "WEB", + "url": "http://www.securitytracker.com/id/1038781" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:20:19Z", + "nvd_published_at": "2019-01-15T21:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-q3p9-8728-wq7x/GHSA-q3p9-8728-wq7x.json b/advisories/github-reviewed/2022/05/GHSA-q3p9-8728-wq7x/GHSA-q3p9-8728-wq7x.json new file mode 100644 index 00000000000..bf7a63a5400 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-q3p9-8728-wq7x/GHSA-q3p9-8728-wq7x.json @@ -0,0 +1,138 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q3p9-8728-wq7x", + "modified": "2024-04-23T17:19:46Z", + "published": "2022-05-17T03:57:19Z", + "aliases": [ + "CVE-2016-3169" + ], + "summary": "Drupal saving user accounts can sometimes grant the user all roles", + "details": "The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0" + }, + { + "fixed": "6.38" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.43" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.43" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0" + }, + { + "fixed": "6.38" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3169" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3169.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3169.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/SA-CORE-2016-001" + }, + { + "type": "WEB", + "url": "http://www.debian.org/security/2016/dsa-3498" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2016/02/24/19" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2016/03/15/10" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:19:46Z", + "nvd_published_at": "2016-04-12T15:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-qqxc-cppg-4xp8/GHSA-qqxc-cppg-4xp8.json b/advisories/github-reviewed/2022/05/GHSA-qqxc-cppg-4xp8/GHSA-qqxc-cppg-4xp8.json new file mode 100644 index 00000000000..6913aab69c2 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-qqxc-cppg-4xp8/GHSA-qqxc-cppg-4xp8.json @@ -0,0 +1,138 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qqxc-cppg-4xp8", + "modified": "2024-04-23T17:19:29Z", + "published": "2022-05-17T03:57:06Z", + "aliases": [ + "CVE-2016-3168" + ], + "summary": "Drupal Reflected file download vulnerability", + "details": "The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a \"reflected file download vulnerability.\"", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0" + }, + { + "fixed": "6.38" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.43" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.43" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0" + }, + { + "fixed": "6.38" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3168" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3168.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3168.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/SA-CORE-2016-001" + }, + { + "type": "WEB", + "url": "http://www.debian.org/security/2016/dsa-3498" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2016/02/24/19" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2016/03/15/10" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:19:29Z", + "nvd_published_at": "2016-04-12T15:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-w7qx-vwr9-2j3r/GHSA-w7qx-vwr9-2j3r.json b/advisories/github-reviewed/2022/05/GHSA-w7qx-vwr9-2j3r/GHSA-w7qx-vwr9-2j3r.json new file mode 100644 index 00000000000..62ebc46bd63 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-w7qx-vwr9-2j3r/GHSA-w7qx-vwr9-2j3r.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w7qx-vwr9-2j3r", + "modified": "2024-04-23T17:20:43Z", + "published": "2022-05-13T01:46:32Z", + "aliases": [ + "CVE-2017-6377" + ], + "summary": "Drupal editor module incorrectly checks access to inline private files", + "details": "When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.2.0" + }, + { + "fixed": "8.2.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.2.0" + }, + { + "fixed": "8.2.7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6377" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6377.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6377.yaml" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/SA-2017-001" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/96919" + }, + { + "type": "WEB", + "url": "http://www.securitytracker.com/id/1038058" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:20:42Z", + "nvd_published_at": "2017-03-16T14:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-3gx6-h57h-rm27/GHSA-3gx6-h57h-rm27.json b/advisories/unreviewed/2022/05/GHSA-3gx6-h57h-rm27/GHSA-3gx6-h57h-rm27.json deleted file mode 100644 index d9daa43bc5d..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-3gx6-h57h-rm27/GHSA-3gx6-h57h-rm27.json +++ /dev/null @@ -1,58 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-3gx6-h57h-rm27", - "modified": "2022-05-13T01:22:41Z", - "published": "2022-05-13T01:22:41Z", - "aliases": [ - "CVE-2019-6340" - ], - "details": "Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6340" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-core-2019-003" - }, - { - "type": "WEB", - "url": "https://www.exploit-db.com/exploits/46452" - }, - { - "type": "WEB", - "url": "https://www.exploit-db.com/exploits/46459" - }, - { - "type": "WEB", - "url": "https://www.exploit-db.com/exploits/46510" - }, - { - "type": "WEB", - "url": "https://www.synology.com/security/advisory/Synology_SA_19_09" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/107106" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-502" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-02-21T21:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-h377-287m-w2r9/GHSA-h377-287m-w2r9.json b/advisories/unreviewed/2022/05/GHSA-h377-287m-w2r9/GHSA-h377-287m-w2r9.json deleted file mode 100644 index dd12fb246e5..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-h377-287m-w2r9/GHSA-h377-287m-w2r9.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-h377-287m-w2r9", - "modified": "2022-05-13T01:36:23Z", - "published": "2022-05-13T01:36:23Z", - "aliases": [ - "CVE-2017-6921" - ], - "details": "In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6921" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/99222" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1038781" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-01-15T21:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-q3p9-8728-wq7x/GHSA-q3p9-8728-wq7x.json b/advisories/unreviewed/2022/05/GHSA-q3p9-8728-wq7x/GHSA-q3p9-8728-wq7x.json deleted file mode 100644 index 529dd1b8ecb..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-q3p9-8728-wq7x/GHSA-q3p9-8728-wq7x.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-q3p9-8728-wq7x", - "modified": "2022-05-17T03:57:19Z", - "published": "2022-05-17T03:57:19Z", - "aliases": [ - "CVE-2016-3169" - ], - "details": "The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3169" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/SA-CORE-2016-001" - }, - { - "type": "WEB", - "url": "http://www.debian.org/security/2016/dsa-3498" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2016/02/24/19" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2016/03/15/10" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2016-04-12T15:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-qqxc-cppg-4xp8/GHSA-qqxc-cppg-4xp8.json b/advisories/unreviewed/2022/05/GHSA-qqxc-cppg-4xp8/GHSA-qqxc-cppg-4xp8.json deleted file mode 100644 index f0d2a292a0f..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-qqxc-cppg-4xp8/GHSA-qqxc-cppg-4xp8.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-qqxc-cppg-4xp8", - "modified": "2022-05-17T03:57:06Z", - "published": "2022-05-17T03:57:06Z", - "aliases": [ - "CVE-2016-3168" - ], - "details": "The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a \"reflected file download vulnerability.\"", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3168" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/SA-CORE-2016-001" - }, - { - "type": "WEB", - "url": "http://www.debian.org/security/2016/dsa-3498" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2016/02/24/19" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2016/03/15/10" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2016-04-12T15:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-w7qx-vwr9-2j3r/GHSA-w7qx-vwr9-2j3r.json b/advisories/unreviewed/2022/05/GHSA-w7qx-vwr9-2j3r/GHSA-w7qx-vwr9-2j3r.json deleted file mode 100644 index 60bcd5a3b8a..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-w7qx-vwr9-2j3r/GHSA-w7qx-vwr9-2j3r.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-w7qx-vwr9-2j3r", - "modified": "2022-05-13T01:46:32Z", - "published": "2022-05-13T01:46:32Z", - "aliases": [ - "CVE-2017-6377" - ], - "details": "When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6377" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/SA-2017-001" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/96919" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1038058" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-863" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-03-16T14:59:00Z" - } -} \ No newline at end of file