Publish Advisories

GHSA-4j3w-g62x-hrcp
GHSA-hf26-vvmx-x8c8
GHSA-r7j4-82xw-8m9p

advisories/github-reviewed/2022/05/GHSA-4j3w-g62x-hrcp/GHSA-4j3w-g62x-hrcp.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4j3w-g62x-hrcp",
-  "modified": "2024-11-22T20:13:55Z",
+  "modified": "2024-11-26T16:50:55Z",
   "published": "2022-05-01T23:28:05Z",
   "aliases": [
     "CVE-2008-0164"
@@ -9,7 +9,14 @@
   "summary": "Plone Cross-site request forgery (CSRF)",
   "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS before 3.1 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -57,10 +64,6 @@
       "type": "WEB",
       "url": "http://plone.org/products/plone-hotfix/releases/CVE-2008-0164"
     },
-    {
-      "type": "WEB",
-      "url": "http://securityreason.com/securityalert/3754"
-    },
     {
       "type": "WEB",
       "url": "http://www.procheckup.com/Hacking_Plone_CMS.pdf"
@@ -70,7 +73,7 @@
     "cwe_ids": [
       "CWE-352"
     ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2024-05-14T17:23:26Z",
     "nvd_published_at": "2008-03-20T00:44:00Z"

advisories/github-reviewed/2022/05/GHSA-hf26-vvmx-x8c8/GHSA-hf26-vvmx-x8c8.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hf26-vvmx-x8c8",
-  "modified": "2024-11-22T20:13:16Z",
+  "modified": "2024-11-26T16:50:13Z",
   "published": "2022-05-01T18:36:14Z",
   "aliases": [
     "CVE-2007-5741"
@@ -9,13 +9,20 @@
   "summary": "Plone Arbitrary Code Execution via Unsafe Handling of Pickles",
   "details": "Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
       "package": {
         "ecosystem": "PyPI",
-        "name": "plone"
+        "name": "Plone"
       },
       "ranges": [
         {
@@ -37,7 +44,7 @@
     {
       "package": {
         "ecosystem": "PyPI",
-        "name": "plone"
+        "name": "Plone"
       },
       "ranges": [
         {
@@ -66,6 +73,10 @@
       "type": "WEB",
       "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38288"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/plone/Plone"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2007-4.yaml"
@@ -95,7 +106,7 @@
     "cwe_ids": [
       "CWE-94"
     ],
-    "severity": "HIGH",
+    "severity": "CRITICAL",
     "github_reviewed": true,
     "github_reviewed_at": "2023-09-22T21:57:47Z",
     "nvd_published_at": "2007-11-07T21:46:00Z"

advisories/github-reviewed/2022/05/GHSA-r7j4-82xw-8m9p/GHSA-r7j4-82xw-8m9p.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-r7j4-82xw-8m9p",
-  "modified": "2024-11-22T20:12:29Z",
+  "modified": "2024-11-26T16:48:59Z",
   "published": "2022-05-01T07:16:48Z",
   "aliases": [
     "CVE-2006-4249"
@@ -9,7 +9,14 @@
   "summary": "Plone allows a user to masquerade as a group",
   "details": "Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to \"masquerade as a group.\"",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"
+    }
   ],
   "affected": [
     {