Publish Advisories

GHSA-77hv-8796-8ccp
GHSA-879r-7f3w-8jj3

advisories/github-reviewed/2018/07/GHSA-77hv-8796-8ccp/GHSA-77hv-8796-8ccp.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-77hv-8796-8ccp",
-  "modified": "2023-02-03T20:31:42Z",
+  "modified": "2024-10-11T20:53:34Z",
   "published": "2018-07-23T19:51:50Z",
   "aliases": [
     "CVE-2012-5486"
@@ -9,7 +9,14 @@
   "summary": "HTTP header injection in Plone and Zope2",
   "details": "ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -98,6 +105,14 @@
       "type": "ADVISORY",
       "url": "https://github.com/advisories/GHSA-77hv-8796-8ccp"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-28.yaml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-73.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://plone.org/products/plone-hotfix/releases/20121106"
@@ -119,7 +134,7 @@
     "cwe_ids": [
 
     ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2020-06-16T21:21:53Z",
     "nvd_published_at": "2014-09-30T14:55:00Z"

advisories/github-reviewed/2018/07/GHSA-879r-7f3w-8jj3/GHSA-879r-7f3w-8jj3.json

@@ -1,15 +1,22 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-879r-7f3w-8jj3",
-  "modified": "2020-06-16T21:24:39Z",
+  "modified": "2024-10-11T20:52:23Z",
   "published": "2018-07-23T19:52:06Z",
   "aliases": [
     "CVE-2012-5489"
   ],
-  "summary": "Moderate severity vulnerability that affects Plone and Zope2",
+  "summary": "Plone and Zope2 vulnerable to unauthorized access to restricted attributes",
   "details": "The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -109,6 +116,14 @@
       "type": "WEB",
       "url": "https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-31.yaml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-74.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://plone.org/products/plone-hotfix/releases/20121106"
@@ -124,9 +139,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-863"
     ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2020-06-16T21:24:39Z",
     "nvd_published_at": null