diff --git a/advisories/unreviewed/2022/02/GHSA-43x9-7hfv-mxrf/GHSA-43x9-7hfv-mxrf.json b/advisories/github-reviewed/2022/02/GHSA-43x9-7hfv-mxrf/GHSA-43x9-7hfv-mxrf.json similarity index 56% rename from advisories/unreviewed/2022/02/GHSA-43x9-7hfv-mxrf/GHSA-43x9-7hfv-mxrf.json rename to advisories/github-reviewed/2022/02/GHSA-43x9-7hfv-mxrf/GHSA-43x9-7hfv-mxrf.json index 72cf98a7ebe..6c8787de108 100644 --- a/advisories/unreviewed/2022/02/GHSA-43x9-7hfv-mxrf/GHSA-43x9-7hfv-mxrf.json +++ b/advisories/github-reviewed/2022/02/GHSA-43x9-7hfv-mxrf/GHSA-43x9-7hfv-mxrf.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-43x9-7hfv-mxrf", - "modified": "2022-03-17T00:05:11Z", + "modified": "2024-04-02T20:31:01Z", "published": "2022-02-26T00:00:39Z", "aliases": [ "CVE-2021-37504" ], + "summary": "jQuery-Upload-File XSS in fileNameStr", "details": "A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.", "severity": [ { @@ -14,40 +15,38 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "jquery-file-upload" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.0.11" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37504" }, + { + "type": "PACKAGE", + "url": "https://github.com/hayageek/jquery-upload-file" + }, { "type": "WEB", "url": "https://github.com/hayageek/jquery-upload-file/blob/master/js/jquery.uploadfile.js#L469" - }, - { - "type": "WEB", - "url": "https://raw.githubusercontent.com/hayageek/jquery-upload-file/master/js/jquery.uploadfile.js" - }, - { - "type": "WEB", - "url": "http://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js" - }, - { - "type": "WEB", - "url": "http://hayageek.github.io/jQuery-Upload-File/4.0.11/jquery.uploadfile.min.js" - }, - { - "type": "WEB", - "url": "http://hayageek.github.io/jQuery-Upload-File/4.0.11/uploadfile.css" - }, - { - "type": "WEB", - "url": "http://haygeek.com" - }, - { - "type": "WEB", - "url": "http://jquery-upload-file.com" } ], "database_specific": { @@ -55,8 +54,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-02T20:31:01Z", "nvd_published_at": "2022-02-25T19:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/09/GHSA-hr3v-8cp3-68rf/GHSA-hr3v-8cp3-68rf.json b/advisories/github-reviewed/2022/09/GHSA-hr3v-8cp3-68rf/GHSA-hr3v-8cp3-68rf.json new file mode 100644 index 00000000000..6e36b55b7ce --- /dev/null +++ b/advisories/github-reviewed/2022/09/GHSA-hr3v-8cp3-68rf/GHSA-hr3v-8cp3-68rf.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hr3v-8cp3-68rf", + "modified": "2024-04-02T20:30:12Z", + "published": "2022-09-25T00:00:15Z", + "aliases": [ + "CVE-2021-41803" + ], + "summary": "HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions", + "details": "HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/consul" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.8.1" + }, + { + "fixed": "1.11.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/consul" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.12.0" + }, + { + "fixed": "1.12.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/consul" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.13.0" + }, + { + "fixed": "1.13.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41803" + }, + { + "type": "WEB", + "url": "https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627" + }, + { + "type": "PACKAGE", + "url": "https://github.com/hashicorp/consul" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-02T20:30:12Z", + "nvd_published_at": "2022-09-23T01:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/09/GHSA-hr3v-8cp3-68rf/GHSA-hr3v-8cp3-68rf.json b/advisories/unreviewed/2022/09/GHSA-hr3v-8cp3-68rf/GHSA-hr3v-8cp3-68rf.json deleted file mode 100644 index 2db3180e79f..00000000000 --- a/advisories/unreviewed/2022/09/GHSA-hr3v-8cp3-68rf/GHSA-hr3v-8cp3-68rf.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hr3v-8cp3-68rf", - "modified": "2022-09-25T00:00:15Z", - "published": "2022-09-25T00:00:15Z", - "aliases": [ - "CVE-2021-41803" - ], - "details": "HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.\"", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41803" - }, - { - "type": "WEB", - "url": "https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI" - }, - { - "type": "WEB", - "url": "https://www.hashicorp.com/blog/category/consul" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-862" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-09-23T01:15:00Z" - } -} \ No newline at end of file