diff --git a/advisories/unreviewed/2022/05/GHSA-5hr6-r8h6-wh22/GHSA-5hr6-r8h6-wh22.json b/advisories/github-reviewed/2022/05/GHSA-5hr6-r8h6-wh22/GHSA-5hr6-r8h6-wh22.json similarity index 65% rename from advisories/unreviewed/2022/05/GHSA-5hr6-r8h6-wh22/GHSA-5hr6-r8h6-wh22.json rename to advisories/github-reviewed/2022/05/GHSA-5hr6-r8h6-wh22/GHSA-5hr6-r8h6-wh22.json index cbaff26c036..d432bedb09b 100644 --- a/advisories/unreviewed/2022/05/GHSA-5hr6-r8h6-wh22/GHSA-5hr6-r8h6-wh22.json +++ b/advisories/github-reviewed/2022/05/GHSA-5hr6-r8h6-wh22/GHSA-5hr6-r8h6-wh22.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-5hr6-r8h6-wh22", - "modified": "2022-07-29T00:00:48Z", + "modified": "2024-04-23T17:09:16Z", "published": "2022-05-24T19:05:47Z", "aliases": [ "CVE-2021-24374" ], + "summary": "JetPack Exposure of Resource to Wrong Sphere", "details": "The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a \"carousel\" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "automattic/jetpack" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "9.8" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24374" }, + { + "type": "PACKAGE", + "url": "https://github.com/Automattic/jetpack-production" + }, { "type": "WEB", "url": "https://jetpack.com/2021/06/01/jetpack-9-8-engage-your-audience-with-wordpress-stories" @@ -37,8 +60,8 @@ "CWE-668" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:09:16Z", "nvd_published_at": "2021-06-21T20:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-7vrp-3pff-c3j4/GHSA-7vrp-3pff-c3j4.json b/advisories/github-reviewed/2022/05/GHSA-7vrp-3pff-c3j4/GHSA-7vrp-3pff-c3j4.json similarity index 65% rename from advisories/unreviewed/2022/05/GHSA-7vrp-3pff-c3j4/GHSA-7vrp-3pff-c3j4.json rename to advisories/github-reviewed/2022/05/GHSA-7vrp-3pff-c3j4/GHSA-7vrp-3pff-c3j4.json index 124fa4b886a..e45ba4e6891 100644 --- a/advisories/unreviewed/2022/05/GHSA-7vrp-3pff-c3j4/GHSA-7vrp-3pff-c3j4.json +++ b/advisories/github-reviewed/2022/05/GHSA-7vrp-3pff-c3j4/GHSA-7vrp-3pff-c3j4.json @@ -1,17 +1,29 @@ { "schema_version": "1.4.0", "id": "GHSA-7vrp-3pff-c3j4", - "modified": "2022-05-24T17:37:27Z", + "modified": "2024-04-23T17:08:37Z", "published": "2022-05-24T17:37:27Z", "aliases": [ "CVE-2020-29471" ], + "summary": "OpenCart Stored Cross-Site Scripting", "details": "OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "opencart/opencart" + }, + "versions": [ + "3.0.3.6" + ] + } ], "references": [ { @@ -28,8 +40,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:08:37Z", "nvd_published_at": "2020-12-29T17:15:00Z" } } \ No newline at end of file