diff --git a/advisories/unreviewed/2023/10/GHSA-5h47-9rm5-fx3f/GHSA-5h47-9rm5-fx3f.json b/advisories/github-reviewed/2023/10/GHSA-5h47-9rm5-fx3f/GHSA-5h47-9rm5-fx3f.json similarity index 55% rename from advisories/unreviewed/2023/10/GHSA-5h47-9rm5-fx3f/GHSA-5h47-9rm5-fx3f.json rename to advisories/github-reviewed/2023/10/GHSA-5h47-9rm5-fx3f/GHSA-5h47-9rm5-fx3f.json index 36ea6ff28a8..db41c700fce 100644 --- a/advisories/unreviewed/2023/10/GHSA-5h47-9rm5-fx3f/GHSA-5h47-9rm5-fx3f.json +++ b/advisories/github-reviewed/2023/10/GHSA-5h47-9rm5-fx3f/GHSA-5h47-9rm5-fx3f.json @@ -1,23 +1,46 @@ { "schema_version": "1.4.0", "id": "GHSA-5h47-9rm5-fx3f", - "modified": "2023-10-20T00:30:24Z", + "modified": "2023-10-20T22:26:43Z", "published": "2023-10-20T00:30:24Z", "aliases": [ "CVE-2023-43341" ], + "summary": "Evolution CMS Cross-site Scripting vulnerability", "details": "Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "evolutioncms/evolution" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "3.2.3" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43341" }, + { + "type": "PACKAGE", + "url": "https://github.com/evolution-cms/evolution" + }, { "type": "WEB", "url": "https://github.com/sromanhu/CVE-2023-43341-Evolution-Reflected-XSS---Installation-Connection-" @@ -29,11 +52,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-10-20T22:26:43Z", "nvd_published_at": null } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/10/GHSA-rxrc-rgv4-jpvx/GHSA-rxrc-rgv4-jpvx.json b/advisories/github-reviewed/2023/10/GHSA-rxrc-rgv4-jpvx/GHSA-rxrc-rgv4-jpvx.json similarity index 51% rename from advisories/unreviewed/2023/10/GHSA-rxrc-rgv4-jpvx/GHSA-rxrc-rgv4-jpvx.json rename to advisories/github-reviewed/2023/10/GHSA-rxrc-rgv4-jpvx/GHSA-rxrc-rgv4-jpvx.json index b480104822c..4769bc53a01 100644 --- a/advisories/unreviewed/2023/10/GHSA-rxrc-rgv4-jpvx/GHSA-rxrc-rgv4-jpvx.json +++ b/advisories/github-reviewed/2023/10/GHSA-rxrc-rgv4-jpvx/GHSA-rxrc-rgv4-jpvx.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rxrc-rgv4-jpvx", - "modified": "2023-10-19T15:31:08Z", + "modified": "2023-10-20T22:26:13Z", "published": "2023-10-19T15:31:08Z", "aliases": [ "CVE-2023-5654" ], + "summary": "React Developer Tools extension Improper Authorization vulnerability", "details": "The React Developer Tools extension registers a message listener with window.addEventListener('message', ) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser.", "severity": [ { @@ -14,25 +15,59 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "react-devtools-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.28.4" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5654" }, + { + "type": "WEB", + "url": "https://github.com/facebook/react/pull/27417" + }, + { + "type": "WEB", + "url": "https://github.com/facebook/react/commit/09285d5a7f1c08bec09f44cec3d0518a603597fc" + }, + { + "type": "WEB", + "url": "https://github.com/facebook/react/commit/94d5b5b2bf5204ebd289a113989c0e2c51b626ef" + }, { "type": "WEB", "url": "https://gist.github.com/CalumHutton/1fb89b64409570a43f89d1fd3274b231" + }, + { + "type": "PACKAGE", + "url": "https://github.com/facebook/react" } ], "database_specific": { "cwe_ids": [ "CWE-285" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-10-20T22:26:13Z", "nvd_published_at": null } } \ No newline at end of file