Publish Advisories

GHSA-5hr6-r8h6-wh22
GHSA-7vrp-3pff-c3j4

advisories/github-reviewed/2022/05/GHSA-5hr6-r8h6-wh22/GHSA-5hr6-r8h6-wh22.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-5hr6-r8h6-wh22",
-  "modified": "2022-07-29T00:00:48Z",
+  "modified": "2024-04-23T17:09:16Z",
   "published": "2022-05-24T19:05:47Z",
   "aliases": [
     "CVE-2021-24374"
   ],
+  "summary": "JetPack Exposure of Resource to Wrong Sphere",
   "details": "The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a \"carousel\" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked.",
   "severity": [
     {
@@ -14,13 +15,35 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "automattic/jetpack"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "9.8"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24374"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Automattic/jetpack-production"
+    },
     {
       "type": "WEB",
       "url": "https://jetpack.com/2021/06/01/jetpack-9-8-engage-your-audience-with-wordpress-stories"
@@ -37,8 +60,8 @@
       "CWE-668"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-04-23T17:09:16Z",
     "nvd_published_at": "2021-06-21T20:15:00Z"
   }
 }

advisories/github-reviewed/2022/05/GHSA-7vrp-3pff-c3j4/GHSA-7vrp-3pff-c3j4.json

@@ -1,17 +1,29 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7vrp-3pff-c3j4",
-  "modified": "2022-05-24T17:37:27Z",
+  "modified": "2024-04-23T17:08:37Z",
   "published": "2022-05-24T17:37:27Z",
   "aliases": [
     "CVE-2020-29471"
   ],
+  "summary": "OpenCart Stored Cross-Site Scripting",
   "details": "OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
+    }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "opencart/opencart"
+      },
+      "versions": [
+        "3.0.3.6"
+      ]
+    }
   ],
   "references": [
     {
@@ -28,8 +40,8 @@
       "CWE-79"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-04-23T17:08:37Z",
     "nvd_published_at": "2020-12-29T17:15:00Z"
   }
 }