diff --git a/advisories/github-reviewed/2023/05/GHSA-g82w-58jf-gcxx/GHSA-g82w-58jf-gcxx.json b/advisories/github-reviewed/2023/05/GHSA-g82w-58jf-gcxx/GHSA-g82w-58jf-gcxx.json index 7fed783d0f8..00765f1178f 100644 --- a/advisories/github-reviewed/2023/05/GHSA-g82w-58jf-gcxx/GHSA-g82w-58jf-gcxx.json +++ b/advisories/github-reviewed/2023/05/GHSA-g82w-58jf-gcxx/GHSA-g82w-58jf-gcxx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g82w-58jf-gcxx", - "modified": "2023-06-07T16:04:02Z", + "modified": "2025-02-13T18:57:13Z", "published": "2023-05-26T13:59:19Z", "aliases": [ "CVE-2023-2878" diff --git a/advisories/github-reviewed/2023/06/GHSA-65wh-g8x8-gm2h/GHSA-65wh-g8x8-gm2h.json b/advisories/github-reviewed/2023/06/GHSA-65wh-g8x8-gm2h/GHSA-65wh-g8x8-gm2h.json index eb744ae37c6..546ab44913c 100644 --- a/advisories/github-reviewed/2023/06/GHSA-65wh-g8x8-gm2h/GHSA-65wh-g8x8-gm2h.json +++ b/advisories/github-reviewed/2023/06/GHSA-65wh-g8x8-gm2h/GHSA-65wh-g8x8-gm2h.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-65wh-g8x8-gm2h", - "modified": "2024-10-14T14:12:13Z", + "modified": "2025-02-13T18:57:09Z", "published": "2023-06-12T18:30:18Z", "aliases": [ "CVE-2023-34212" ], "summary": "Apache NiFi vulnerable to Deserialization of Untrusted Data", - "details": "The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.\n\nThe resolution validates the JNDI URL and restricts locations to a set of allowed schemes.\n\nYou are recommended to upgrade to version 1.22.0 or later which fixes this issue.\n\n\n", + "details": "The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.\n\nThe resolution validates the JNDI URL and restricts locations to a set of allowed schemes.\n\nYou are recommended to upgrade to version 1.22.0 or later which fixes this issue.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2023/06/GHSA-wm7r-3qxj-5xgq/GHSA-wm7r-3qxj-5xgq.json b/advisories/github-reviewed/2023/06/GHSA-wm7r-3qxj-5xgq/GHSA-wm7r-3qxj-5xgq.json index f4d495efb7c..13a0730d933 100644 --- a/advisories/github-reviewed/2023/06/GHSA-wm7r-3qxj-5xgq/GHSA-wm7r-3qxj-5xgq.json +++ b/advisories/github-reviewed/2023/06/GHSA-wm7r-3qxj-5xgq/GHSA-wm7r-3qxj-5xgq.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-wm7r-3qxj-5xgq", - "modified": "2023-06-09T22:54:42Z", + "modified": "2025-02-13T18:57:03Z", "published": "2023-06-06T21:30:18Z", "withdrawn": "2023-06-09T22:54:42Z", "aliases": [], "summary": "Duplicate Advisory: Grafana Improper Access Control vulnerability", - "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-cvm3-pp2j-chr3. This link is maintained to preserve external references.\n\n## Original Description\nGrafana is an open-source platform for monitoring and observability. \n\nThe option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.\n\nThis might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.\n\nUsers may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.\n\n", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-cvm3-pp2j-chr3. This link is maintained to preserve external references.\n\n## Original Description\nGrafana is an open-source platform for monitoring and observability. \n\nThe option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.\n\nThis might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.\n\nUsers may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2023/06/GHSA-x2w4-c67p-g44j/GHSA-x2w4-c67p-g44j.json b/advisories/github-reviewed/2023/06/GHSA-x2w4-c67p-g44j/GHSA-x2w4-c67p-g44j.json index f1691e485a7..f1968bf4703 100644 --- a/advisories/github-reviewed/2023/06/GHSA-x2w4-c67p-g44j/GHSA-x2w4-c67p-g44j.json +++ b/advisories/github-reviewed/2023/06/GHSA-x2w4-c67p-g44j/GHSA-x2w4-c67p-g44j.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-x2w4-c67p-g44j", - "modified": "2023-06-07T15:08:08Z", + "modified": "2025-02-13T18:56:29Z", "published": "2023-06-06T21:30:18Z", "aliases": [ "CVE-2023-2801"