diff --git a/advisories/github-reviewed/2020/07/GHSA-33c7-2mpw-hg34/GHSA-33c7-2mpw-hg34.json b/advisories/github-reviewed/2020/07/GHSA-33c7-2mpw-hg34/GHSA-33c7-2mpw-hg34.json index 5dbdf197276..a24dcef9871 100644 --- a/advisories/github-reviewed/2020/07/GHSA-33c7-2mpw-hg34/GHSA-33c7-2mpw-hg34.json +++ b/advisories/github-reviewed/2020/07/GHSA-33c7-2mpw-hg34/GHSA-33c7-2mpw-hg34.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-33c7-2mpw-hg34", - "modified": "2021-07-29T21:17:18Z", + "modified": "2023-10-02T18:44:26Z", "published": "2020-07-29T18:07:16Z", "aliases": [ "CVE-2020-7694" @@ -20,6 +20,11 @@ "ecosystem": "PyPI", "name": "uvicorn" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", @@ -42,6 +47,14 @@ }, { "type": "WEB", + "url": "https://github.com/encode/uvicorn/issues/723" + }, + { + "type": "WEB", + "url": "https://github.com/encode/uvicorn/commit/895807f94ea9a8e588605c12076b7d7517cda503" + }, + { + "type": "PACKAGE", "url": "https://github.com/encode/uvicorn" }, { diff --git a/advisories/github-reviewed/2020/09/GHSA-2ggq-vfcp-gwhj/GHSA-2ggq-vfcp-gwhj.json b/advisories/github-reviewed/2020/09/GHSA-2ggq-vfcp-gwhj/GHSA-2ggq-vfcp-gwhj.json index 394417d600e..22ca08dec6b 100644 --- a/advisories/github-reviewed/2020/09/GHSA-2ggq-vfcp-gwhj/GHSA-2ggq-vfcp-gwhj.json +++ b/advisories/github-reviewed/2020/09/GHSA-2ggq-vfcp-gwhj/GHSA-2ggq-vfcp-gwhj.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-2ggq-vfcp-gwhj", - "modified": "2021-10-04T20:48:50Z", + "modified": "2023-10-02T18:43:16Z", "published": "2020-09-04T17:33:53Z", "aliases": [ ], "summary": "Cross-Site Scripting in @hapi/boom", - "details": "Versions of `@hapi/boom` prior t 0.3.8 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 0.3.8 or later.", + "details": "Versions of `@hapi/boom` prior to 0.3.8 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 0.3.8 or later.", "severity": [ { "type": "CVSS_V3", @@ -20,6 +20,11 @@ "ecosystem": "npm", "name": "@hapi/boom" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", @@ -36,6 +41,10 @@ } ], "references": [ + { + "type": "WEB", + "url": "https://github.com/hapijs/boom/commit/0f8640bdba65aec6e6799bfc16ff5753150bfcaf" + }, { "type": "PACKAGE", "url": "https://github.com/hapijs/boom" @@ -43,10 +52,6 @@ { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JS-HAPIBOOM-541183" - }, - { - "type": "WEB", - "url": "https://www.npmjs.com/advisories/1459" } ], "database_specific": {