From 5ee70be046b39d1b66d32a2192a2fdbdc11f912e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 22 Apr 2024 23:12:59 +0000 Subject: [PATCH] Publish Advisories GHSA-jr64-pggr-j8xj GHSA-pcv5-m2wh-66j3 GHSA-qgmm-f2qw-r95f GHSA-qgmm-f2qw-r95f --- .../GHSA-jr64-pggr-j8xj.json | 27 ++++++-- .../GHSA-pcv5-m2wh-66j3.json | 40 +++++++++-- .../GHSA-qgmm-f2qw-r95f.json | 66 +++++++++++++++++++ .../GHSA-qgmm-f2qw-r95f.json | 35 ---------- 4 files changed, 124 insertions(+), 44 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-jr64-pggr-j8xj/GHSA-jr64-pggr-j8xj.json (64%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-pcv5-m2wh-66j3/GHSA-pcv5-m2wh-66j3.json (51%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-qgmm-f2qw-r95f/GHSA-qgmm-f2qw-r95f.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-qgmm-f2qw-r95f/GHSA-qgmm-f2qw-r95f.json diff --git a/advisories/unreviewed/2022/05/GHSA-jr64-pggr-j8xj/GHSA-jr64-pggr-j8xj.json b/advisories/github-reviewed/2022/05/GHSA-jr64-pggr-j8xj/GHSA-jr64-pggr-j8xj.json similarity index 64% rename from advisories/unreviewed/2022/05/GHSA-jr64-pggr-j8xj/GHSA-jr64-pggr-j8xj.json rename to advisories/github-reviewed/2022/05/GHSA-jr64-pggr-j8xj/GHSA-jr64-pggr-j8xj.json index ee2f1b1ecab..be231805b76 100644 --- a/advisories/unreviewed/2022/05/GHSA-jr64-pggr-j8xj/GHSA-jr64-pggr-j8xj.json +++ b/advisories/github-reviewed/2022/05/GHSA-jr64-pggr-j8xj/GHSA-jr64-pggr-j8xj.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-jr64-pggr-j8xj", - "modified": "2022-05-14T03:49:58Z", + "modified": "2024-04-22T23:11:42Z", "published": "2022-05-14T03:49:58Z", "aliases": [ "CVE-2017-1000491" ], + "summary": "Shiba vulnerable to XSS leading to code execution", "details": "Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "shiba" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.1.1" + } + ] + } + ] + } ], "references": [ { @@ -35,8 +54,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T23:11:42Z", "nvd_published_at": "2018-01-03T01:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-pcv5-m2wh-66j3/GHSA-pcv5-m2wh-66j3.json b/advisories/github-reviewed/2022/05/GHSA-pcv5-m2wh-66j3/GHSA-pcv5-m2wh-66j3.json similarity index 51% rename from advisories/unreviewed/2022/05/GHSA-pcv5-m2wh-66j3/GHSA-pcv5-m2wh-66j3.json rename to advisories/github-reviewed/2022/05/GHSA-pcv5-m2wh-66j3/GHSA-pcv5-m2wh-66j3.json index fc2a70436e0..45195bf7811 100644 --- a/advisories/unreviewed/2022/05/GHSA-pcv5-m2wh-66j3/GHSA-pcv5-m2wh-66j3.json +++ b/advisories/github-reviewed/2022/05/GHSA-pcv5-m2wh-66j3/GHSA-pcv5-m2wh-66j3.json @@ -1,23 +1,53 @@ { "schema_version": "1.4.0", "id": "GHSA-pcv5-m2wh-66j3", - "modified": "2022-05-24T17:43:50Z", + "modified": "2024-04-22T23:11:37Z", "published": "2022-05-24T17:43:50Z", "aliases": [ "CVE-2020-27838" ], + "summary": "Keycloak discloses information without authentication", "details": "A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27838" }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/pull/7790" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/commit/9356843c6c3d7097d010b3bb6f91e25fcaba378c" + }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1906797" @@ -28,8 +58,8 @@ "CWE-287" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T23:11:37Z", "nvd_published_at": "2021-03-08T22:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-qgmm-f2qw-r95f/GHSA-qgmm-f2qw-r95f.json b/advisories/github-reviewed/2022/05/GHSA-qgmm-f2qw-r95f/GHSA-qgmm-f2qw-r95f.json new file mode 100644 index 00000000000..467a7f10b96 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-qgmm-f2qw-r95f/GHSA-qgmm-f2qw-r95f.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qgmm-f2qw-r95f", + "modified": "2024-04-22T23:11:33Z", + "published": "2022-05-24T17:17:37Z", + "aliases": [ + "CVE-2020-1698" + ], + "summary": "Keycloak leaks sensitive information in logged exceptions", + "details": "A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerability is to data confidentiality.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "9.0.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1698" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/pull/6751" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/commit/62c9e1577618470832ede22dcedd46cba15b1836" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1698" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200", + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T23:11:33Z", + "nvd_published_at": "2020-05-11T14:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-qgmm-f2qw-r95f/GHSA-qgmm-f2qw-r95f.json b/advisories/unreviewed/2022/05/GHSA-qgmm-f2qw-r95f/GHSA-qgmm-f2qw-r95f.json deleted file mode 100644 index 178f343af58..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-qgmm-f2qw-r95f/GHSA-qgmm-f2qw-r95f.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-qgmm-f2qw-r95f", - "modified": "2022-05-24T17:17:37Z", - "published": "2022-05-24T17:17:37Z", - "aliases": [ - "CVE-2020-1698" - ], - "details": "A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerability is to data confidentiality.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1698" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1698" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-532" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-05-11T14:15:00Z" - } -} \ No newline at end of file