diff --git a/advisories/github-reviewed/2022/05/GHSA-2xv7-fwh6-x7fc/GHSA-2xv7-fwh6-x7fc.json b/advisories/github-reviewed/2022/05/GHSA-2xv7-fwh6-x7fc/GHSA-2xv7-fwh6-x7fc.json new file mode 100644 index 00000000000..70913519d4a --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-2xv7-fwh6-x7fc/GHSA-2xv7-fwh6-x7fc.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2xv7-fwh6-x7fc", + "modified": "2024-04-25T21:53:56Z", + "published": "2022-05-14T02:01:19Z", + "aliases": [ + "CVE-2017-10795" + ], + "summary": "Subrion Cross-site scripting (XSS) vulnerability", + "details": "Cross-site scripting (XSS) vulnerability in Subrion CMS allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "intelliants/subrion" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.1.5" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10795" + }, + { + "type": "WEB", + "url": "https://github.com/intelliants/subrion/issues/467" + }, + { + "type": "PACKAGE", + "url": "https://github.com/intelliants/subrion" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/99378" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:53:56Z", + "nvd_published_at": "2017-07-02T13:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-4f4h-jgjp-3vfg/GHSA-4f4h-jgjp-3vfg.json b/advisories/github-reviewed/2022/05/GHSA-4f4h-jgjp-3vfg/GHSA-4f4h-jgjp-3vfg.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-4f4h-jgjp-3vfg/GHSA-4f4h-jgjp-3vfg.json rename to advisories/github-reviewed/2022/05/GHSA-4f4h-jgjp-3vfg/GHSA-4f4h-jgjp-3vfg.json index 878eac66b97..6dd16a5b54b 100644 --- a/advisories/unreviewed/2022/05/GHSA-4f4h-jgjp-3vfg/GHSA-4f4h-jgjp-3vfg.json +++ b/advisories/github-reviewed/2022/05/GHSA-4f4h-jgjp-3vfg/GHSA-4f4h-jgjp-3vfg.json @@ -1,35 +1,55 @@ { "schema_version": "1.4.0", "id": "GHSA-4f4h-jgjp-3vfg", - "modified": "2022-05-24T17:16:53Z", + "modified": "2024-04-25T21:54:41Z", "published": "2022-05-24T17:16:53Z", "aliases": [ "CVE-2020-12468" ], + "summary": "Subrion CMS CSV injection via Export Language", "details": "Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "intelliants/subrion" + }, + "versions": [ + "4.2.1" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12468" }, + { + "type": "WEB", + "url": "https://belong2yourself.github.io/vulnerabilities/docs/Subrion%20CMS/CSV%20Injection/readme" + }, { "type": "WEB", "url": "https://github.com/belong2yourself/vulnerabilities/tree/master/Subrion%20CMS/CSV%20Injection" + }, + { + "type": "PACKAGE", + "url": "https://github.com/intelliants/subrion" } ], "database_specific": { "cwe_ids": [ ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:54:41Z", "nvd_published_at": "2020-04-29T21:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-4j79-4m6q-77vf/GHSA-4j79-4m6q-77vf.json b/advisories/github-reviewed/2022/05/GHSA-4j79-4m6q-77vf/GHSA-4j79-4m6q-77vf.json new file mode 100644 index 00000000000..1907c6a4ca1 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-4j79-4m6q-77vf/GHSA-4j79-4m6q-77vf.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4j79-4m6q-77vf", + "modified": "2024-04-25T21:54:12Z", + "published": "2022-05-14T02:00:54Z", + "aliases": [ + "CVE-2017-5543" + ], + "summary": "Subrion CMS PHP Object Injection", + "details": "`includes/classes/ia.core.users.php` in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "intelliants/subrion" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.5" + }, + { + "fixed": "4.1.0" + } + ] + } + ], + "versions": [ + "4.0.5" + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5543" + }, + { + "type": "WEB", + "url": "https://github.com/intelliants/subrion/issues/297" + }, + { + "type": "WEB", + "url": "https://github.com/intelliants/subrion/commit/019dee20a38f39a5827aae2eb92f09b1f6afb7bb" + }, + { + "type": "PACKAGE", + "url": "https://github.com/intelliants/subrion" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/95688" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:54:12Z", + "nvd_published_at": "2017-01-20T08:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-6wc4-v4v5-3m82/GHSA-6wc4-v4v5-3m82.json b/advisories/github-reviewed/2022/05/GHSA-6wc4-v4v5-3m82/GHSA-6wc4-v4v5-3m82.json new file mode 100644 index 00000000000..ace5059047c --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-6wc4-v4v5-3m82/GHSA-6wc4-v4v5-3m82.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6wc4-v4v5-3m82", + "modified": "2024-04-25T21:54:23Z", + "published": "2022-05-14T02:00:53Z", + "aliases": [ + "CVE-2018-15563" + ], + "summary": "Subrion CMS Stored Cross-site Scripting (XSS)", + "details": "`_core/admin/pages/add/` in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "intelliants/subrion" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.2.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15563" + }, + { + "type": "WEB", + "url": "https://cxsecurity.com/issue/WLB-2018090261" + }, + { + "type": "PACKAGE", + "url": "https://github.com/intelliants/subrion" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:54:23Z", + "nvd_published_at": "2018-10-02T18:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-9738-c49q-4rgc/GHSA-9738-c49q-4rgc.json b/advisories/github-reviewed/2022/05/GHSA-9738-c49q-4rgc/GHSA-9738-c49q-4rgc.json similarity index 57% rename from advisories/unreviewed/2022/05/GHSA-9738-c49q-4rgc/GHSA-9738-c49q-4rgc.json rename to advisories/github-reviewed/2022/05/GHSA-9738-c49q-4rgc/GHSA-9738-c49q-4rgc.json index 1316314c8c5..dfeef95485e 100644 --- a/advisories/unreviewed/2022/05/GHSA-9738-c49q-4rgc/GHSA-9738-c49q-4rgc.json +++ b/advisories/github-reviewed/2022/05/GHSA-9738-c49q-4rgc/GHSA-9738-c49q-4rgc.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-9738-c49q-4rgc", - "modified": "2022-05-14T02:00:32Z", + "modified": "2024-04-25T21:54:26Z", "published": "2022-05-14T02:00:32Z", "aliases": [ "CVE-2018-16327" ], + "summary": "Subrion Cross-site Scripting (XSS)", "details": "There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.", "severity": [ { @@ -14,7 +15,15 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "intelliants/subrion" + }, + "versions": [ + "4.2.1" + ] + } ], "references": [ { @@ -24,6 +33,14 @@ { "type": "WEB", "url": "https://github.com/intelliants/subrion/issues/771" + }, + { + "type": "WEB", + "url": "https://github.com/intelliants/subrion/commit/ec8e6e8984eeebfaf0d8022f4c07aa508624ee18" + }, + { + "type": "PACKAGE", + "url": "https://github.com/intelliants/subrion" } ], "database_specific": { @@ -31,8 +48,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:54:26Z", "nvd_published_at": "2018-09-01T22:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-c4wx-3x5q-hf4w/GHSA-c4wx-3x5q-hf4w.json b/advisories/github-reviewed/2022/05/GHSA-c4wx-3x5q-hf4w/GHSA-c4wx-3x5q-hf4w.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-c4wx-3x5q-hf4w/GHSA-c4wx-3x5q-hf4w.json rename to advisories/github-reviewed/2022/05/GHSA-c4wx-3x5q-hf4w/GHSA-c4wx-3x5q-hf4w.json index 0bda0bb3eff..dfe851ad8b5 100644 --- a/advisories/unreviewed/2022/05/GHSA-c4wx-3x5q-hf4w/GHSA-c4wx-3x5q-hf4w.json +++ b/advisories/github-reviewed/2022/05/GHSA-c4wx-3x5q-hf4w/GHSA-c4wx-3x5q-hf4w.json @@ -1,23 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-c4wx-3x5q-hf4w", - "modified": "2022-05-24T17:17:57Z", + "modified": "2024-04-25T21:54:34Z", "published": "2022-05-24T17:17:57Z", "aliases": [ "CVE-2019-20390" ], + "summary": "Subrion CMS Cross-Site Request Forgery (CSRF) vulnerability", "details": "A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit an attacker's web page. The application fails to validate the CSRF token for a GET request. An attacker can craft a panel/uploads/read.json?cmd=rm URL (removing this token) and send it to the victim.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "intelliants/subrion" + }, + "versions": [ + "4.2.1" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20390" }, + { + "type": "PACKAGE", + "url": "https://github.com/intelliants/subrion" + }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/157700/Subrion-CMS-4.2.1-Cross-Site-Request-Forgery.html" @@ -25,11 +41,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:54:34Z", "nvd_published_at": "2020-05-15T18:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-fmqq-hw9m-448q/GHSA-fmqq-hw9m-448q.json b/advisories/github-reviewed/2022/05/GHSA-fmqq-hw9m-448q/GHSA-fmqq-hw9m-448q.json new file mode 100644 index 00000000000..0923e5c0b0d --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-fmqq-hw9m-448q/GHSA-fmqq-hw9m-448q.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fmqq-hw9m-448q", + "modified": "2024-04-25T21:54:38Z", + "published": "2022-05-24T17:16:53Z", + "aliases": [ + "CVE-2020-12469" + ], + "summary": "Subrion CMS PHP Object Injection", + "details": "admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "intelliants/subrion" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.2.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12469" + }, + { + "type": "WEB", + "url": "https://belong2yourself.github.io/vulnerabilities/docs/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%20Injection/readme" + }, + { + "type": "WEB", + "url": "https://github.com/belong2yourself/vulnerabilities/tree/master/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%20Injection" + }, + { + "type": "PACKAGE", + "url": "https://github.com/intelliants/subrion" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:54:38Z", + "nvd_published_at": "2020-04-29T21:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-jj94-j4r3-5gr4/GHSA-jj94-j4r3-5gr4.json b/advisories/github-reviewed/2022/05/GHSA-jj94-j4r3-5gr4/GHSA-jj94-j4r3-5gr4.json new file mode 100644 index 00000000000..f6e9b8de974 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-jj94-j4r3-5gr4/GHSA-jj94-j4r3-5gr4.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jj94-j4r3-5gr4", + "modified": "2024-04-25T21:54:28Z", + "published": "2022-05-24T19:10:19Z", + "aliases": [ + "CVE-2020-22330" + ], + "summary": "Subrion Cross-Site Scripting (XSS) vulnerability", + "details": "Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "intelliants/subrion" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.1" + }, + { + "fixed": "4.2.2" + } + ] + } + ], + "versions": [ + "4.2.1" + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-22330" + }, + { + "type": "WEB", + "url": "https://github.com/intelliants/subrion/issues/850" + }, + { + "type": "WEB", + "url": "https://github.com/intelliants/subrion/commit/06950c2f9c4aa69e323cbdd141beabb6a9273ca4" + }, + { + "type": "WEB", + "url": "https://github.com/intelliants/subrion/commit/0e9180d2330a00b1ce8e7ec2e92e0a4e0612f1a9" + }, + { + "type": "PACKAGE", + "url": "https://github.com/intelliants/subrion" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:54:28Z", + "nvd_published_at": "2021-08-06T14:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-xhc3-5pgf-p576/GHSA-xhc3-5pgf-p576.json b/advisories/github-reviewed/2022/05/GHSA-xhc3-5pgf-p576/GHSA-xhc3-5pgf-p576.json similarity index 54% rename from advisories/unreviewed/2022/05/GHSA-xhc3-5pgf-p576/GHSA-xhc3-5pgf-p576.json rename to advisories/github-reviewed/2022/05/GHSA-xhc3-5pgf-p576/GHSA-xhc3-5pgf-p576.json index d33c2bba751..7d302151889 100644 --- a/advisories/unreviewed/2022/05/GHSA-xhc3-5pgf-p576/GHSA-xhc3-5pgf-p576.json +++ b/advisories/github-reviewed/2022/05/GHSA-xhc3-5pgf-p576/GHSA-xhc3-5pgf-p576.json @@ -1,23 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-xhc3-5pgf-p576", - "modified": "2022-05-24T17:46:56Z", + "modified": "2024-04-25T21:54:32Z", "published": "2022-05-24T17:46:56Z", "aliases": [ "CVE-2020-23761" ], + "summary": "subrion CMS Cross Site Scripting (XSS) vulnerability", "details": "Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the \"payment gateway\" column on transactions tab.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "intelliants/subrion" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.2.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-23761" }, + { + "type": "PACKAGE", + "url": "https://github.com/intelliants/subrion" + }, { "type": "WEB", "url": "https://subrion.org" @@ -32,8 +58,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:54:32Z", "nvd_published_at": "2021-04-09T18:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-2xv7-fwh6-x7fc/GHSA-2xv7-fwh6-x7fc.json b/advisories/unreviewed/2022/05/GHSA-2xv7-fwh6-x7fc/GHSA-2xv7-fwh6-x7fc.json deleted file mode 100644 index 0cf88305e42..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-2xv7-fwh6-x7fc/GHSA-2xv7-fwh6-x7fc.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-2xv7-fwh6-x7fc", - "modified": "2022-05-14T02:01:19Z", - "published": "2022-05-14T02:01:19Z", - "aliases": [ - "CVE-2017-10795" - ], - "details": "Cross-site scripting (XSS) vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10795" - }, - { - "type": "WEB", - "url": "https://github.com/intelliants/subrion/issues/467" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/99378" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-07-02T13:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-4j79-4m6q-77vf/GHSA-4j79-4m6q-77vf.json b/advisories/unreviewed/2022/05/GHSA-4j79-4m6q-77vf/GHSA-4j79-4m6q-77vf.json deleted file mode 100644 index b8a8c13aff5..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-4j79-4m6q-77vf/GHSA-4j79-4m6q-77vf.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-4j79-4m6q-77vf", - "modified": "2022-05-14T02:00:54Z", - "published": "2022-05-14T02:00:54Z", - "aliases": [ - "CVE-2017-5543" - ], - "details": "includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5543" - }, - { - "type": "WEB", - "url": "https://github.com/intelliants/subrion/issues/297" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/95688" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-01-20T08:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-6wc4-v4v5-3m82/GHSA-6wc4-v4v5-3m82.json b/advisories/unreviewed/2022/05/GHSA-6wc4-v4v5-3m82/GHSA-6wc4-v4v5-3m82.json deleted file mode 100644 index f90159f29f6..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-6wc4-v4v5-3m82/GHSA-6wc4-v4v5-3m82.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-6wc4-v4v5-3m82", - "modified": "2022-05-14T02:00:53Z", - "published": "2022-05-14T02:00:53Z", - "aliases": [ - "CVE-2018-15563" - ], - "details": "_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15563" - }, - { - "type": "WEB", - "url": "https://cxsecurity.com/issue/WLB-2018090261" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-10-02T18:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-fmqq-hw9m-448q/GHSA-fmqq-hw9m-448q.json b/advisories/unreviewed/2022/05/GHSA-fmqq-hw9m-448q/GHSA-fmqq-hw9m-448q.json deleted file mode 100644 index e389f83213a..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-fmqq-hw9m-448q/GHSA-fmqq-hw9m-448q.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fmqq-hw9m-448q", - "modified": "2022-05-24T17:16:53Z", - "published": "2022-05-24T17:16:53Z", - "aliases": [ - "CVE-2020-12469" - ], - "details": "admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12469" - }, - { - "type": "WEB", - "url": "https://github.com/belong2yourself/vulnerabilities/tree/master/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%20Injection" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-04-29T21:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-jj94-j4r3-5gr4/GHSA-jj94-j4r3-5gr4.json b/advisories/unreviewed/2022/05/GHSA-jj94-j4r3-5gr4/GHSA-jj94-j4r3-5gr4.json deleted file mode 100644 index 63844583cc3..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-jj94-j4r3-5gr4/GHSA-jj94-j4r3-5gr4.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-jj94-j4r3-5gr4", - "modified": "2022-05-24T19:10:19Z", - "published": "2022-05-24T19:10:19Z", - "aliases": [ - "CVE-2020-22330" - ], - "details": "Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-22330" - }, - { - "type": "WEB", - "url": "https://github.com/intelliants/subrion/issues/850" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-08-06T14:15:00Z" - } -} \ No newline at end of file