From 72a82ccf319fd2a4b39177f4a6e213e2a3daadbe Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 25 Apr 2024 20:35:49 +0000
Subject: [PATCH] Publish Advisories

GHSA-9wf6-88x4-6xvj
GHSA-wxg6-f773-g2f7
---
 .../GHSA-9wf6-88x4-6xvj.json                  | 29 +++++++++++++++----
 .../GHSA-wxg6-f773-g2f7.json                  | 21 ++++++++++----
 2 files changed, 39 insertions(+), 11 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-9wf6-88x4-6xvj/GHSA-9wf6-88x4-6xvj.json (53%)
 rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-wxg6-f773-g2f7/GHSA-wxg6-f773-g2f7.json (58%)

diff --git a/advisories/unreviewed/2022/05/GHSA-9wf6-88x4-6xvj/GHSA-9wf6-88x4-6xvj.json b/advisories/github-reviewed/2022/05/GHSA-9wf6-88x4-6xvj/GHSA-9wf6-88x4-6xvj.json
similarity index 53%
rename from advisories/unreviewed/2022/05/GHSA-9wf6-88x4-6xvj/GHSA-9wf6-88x4-6xvj.json
rename to advisories/github-reviewed/2022/05/GHSA-9wf6-88x4-6xvj/GHSA-9wf6-88x4-6xvj.json
index 58bd58bc5f8..f7c0a59317e 100644
--- a/advisories/unreviewed/2022/05/GHSA-9wf6-88x4-6xvj/GHSA-9wf6-88x4-6xvj.json
+++ b/advisories/github-reviewed/2022/05/GHSA-9wf6-88x4-6xvj/GHSA-9wf6-88x4-6xvj.json
@@ -1,12 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9wf6-88x4-6xvj",
-  "modified": "2022-05-13T01:46:49Z",
+  "modified": "2024-04-25T20:34:24Z",
   "published": "2022-05-13T01:46:49Z",
   "aliases": [
     "CVE-2017-6954"
   ],
-  "details": "An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions.",
+  "summary": "BuddyPress Docs plugin Improper Privilege Management",
+  "details": "An issue was discovered in `includes/component.php` in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "buddypress/buddypress"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.9.3"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -39,8 +58,8 @@
       "CWE-269"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-04-25T20:34:24Z",
     "nvd_published_at": "2017-03-17T09:59:00Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/unreviewed/2022/05/GHSA-wxg6-f773-g2f7/GHSA-wxg6-f773-g2f7.json b/advisories/github-reviewed/2022/05/GHSA-wxg6-f773-g2f7/GHSA-wxg6-f773-g2f7.json
similarity index 58%
rename from advisories/unreviewed/2022/05/GHSA-wxg6-f773-g2f7/GHSA-wxg6-f773-g2f7.json
rename to advisories/github-reviewed/2022/05/GHSA-wxg6-f773-g2f7/GHSA-wxg6-f773-g2f7.json
index ef8bfb40970..d4b1da88ce1 100644
--- a/advisories/unreviewed/2022/05/GHSA-wxg6-f773-g2f7/GHSA-wxg6-f773-g2f7.json
+++ b/advisories/github-reviewed/2022/05/GHSA-wxg6-f773-g2f7/GHSA-wxg6-f773-g2f7.json
@@ -1,17 +1,26 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-wxg6-f773-g2f7",
-  "modified": "2022-05-17T19:57:26Z",
+  "modified": "2024-04-25T20:34:52Z",
   "published": "2022-05-17T19:57:26Z",
   "aliases": [
     "CVE-2014-8739"
   ],
-  "details": "Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.",
+  "summary": "jQuery File Upload Plugin Unrestricted file upload vulnerability",
+  "details": "Unrestricted file upload vulnerability in `server/php/UploadHandler.php` in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in `files/`, as exploited in the wild in October 2014.",
   "severity": [
 
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "blueimp/jquery-file-upload"
+      },
+      "versions": [
+        "6.4.4"
+      ]
+    }
   ],
   "references": [
     {
@@ -53,11 +62,11 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-434"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-04-25T20:34:52Z",
     "nvd_published_at": "2020-02-08T18:15:00Z"
   }
 }
\ No newline at end of file