From 7bc50d5aa3b6988c01b3042dbfc13c0e97378155 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 24 Apr 2024 20:45:37 +0000 Subject: [PATCH] Publish Advisories GHSA-57wj-22w9-wm9r GHSA-g5mq-v9hf-958h GHSA-gw37-vmvw-f833 GHSA-jjqq-m998-53jf GHSA-m5rg-g6f9-8wpw GHSA-qm8m-7626-762h --- .../GHSA-57wj-22w9-wm9r.json | 31 ++++++++++++++--- .../GHSA-g5mq-v9hf-958h.json | 34 ++++++++++++++++--- .../GHSA-gw37-vmvw-f833.json | 21 +++++++++--- .../GHSA-jjqq-m998-53jf.json | 34 ++++++++++++++++--- .../GHSA-m5rg-g6f9-8wpw.json | 34 ++++++++++++++++--- .../GHSA-qm8m-7626-762h.json | 31 ++++++++++++++--- 6 files changed, 161 insertions(+), 24 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-57wj-22w9-wm9r/GHSA-57wj-22w9-wm9r.json (68%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-g5mq-v9hf-958h/GHSA-g5mq-v9hf-958h.json (56%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-gw37-vmvw-f833/GHSA-gw37-vmvw-f833.json (62%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-jjqq-m998-53jf/GHSA-jjqq-m998-53jf.json (56%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-m5rg-g6f9-8wpw/GHSA-m5rg-g6f9-8wpw.json (56%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-qm8m-7626-762h/GHSA-qm8m-7626-762h.json (58%) diff --git a/advisories/unreviewed/2022/05/GHSA-57wj-22w9-wm9r/GHSA-57wj-22w9-wm9r.json b/advisories/github-reviewed/2022/05/GHSA-57wj-22w9-wm9r/GHSA-57wj-22w9-wm9r.json similarity index 68% rename from advisories/unreviewed/2022/05/GHSA-57wj-22w9-wm9r/GHSA-57wj-22w9-wm9r.json rename to advisories/github-reviewed/2022/05/GHSA-57wj-22w9-wm9r/GHSA-57wj-22w9-wm9r.json index fd847e67792..0a6863391fa 100644 --- a/advisories/unreviewed/2022/05/GHSA-57wj-22w9-wm9r/GHSA-57wj-22w9-wm9r.json +++ b/advisories/github-reviewed/2022/05/GHSA-57wj-22w9-wm9r/GHSA-57wj-22w9-wm9r.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-57wj-22w9-wm9r", - "modified": "2022-05-14T03:15:06Z", + "modified": "2024-04-24T20:44:36Z", "published": "2022-05-14T03:15:06Z", "aliases": [ "CVE-2018-10094" ], + "summary": "Dolibarr SQL injection vulnerability", "details": "SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.0.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/7ade4e37f24d6859987bb9f6232f604325633fdd" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog" @@ -47,8 +70,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:44:36Z", "nvd_published_at": "2018-05-22T20:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-g5mq-v9hf-958h/GHSA-g5mq-v9hf-958h.json b/advisories/github-reviewed/2022/05/GHSA-g5mq-v9hf-958h/GHSA-g5mq-v9hf-958h.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-g5mq-v9hf-958h/GHSA-g5mq-v9hf-958h.json rename to advisories/github-reviewed/2022/05/GHSA-g5mq-v9hf-958h/GHSA-g5mq-v9hf-958h.json index 6d9d448481d..930ae57a145 100644 --- a/advisories/unreviewed/2022/05/GHSA-g5mq-v9hf-958h/GHSA-g5mq-v9hf-958h.json +++ b/advisories/github-reviewed/2022/05/GHSA-g5mq-v9hf-958h/GHSA-g5mq-v9hf-958h.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-g5mq-v9hf-958h", - "modified": "2022-05-14T03:00:59Z", + "modified": "2024-04-24T20:45:11Z", "published": "2022-05-14T03:00:59Z", "aliases": [ "CVE-2018-13449" ], + "summary": "Dolibarr SQL injection vulnerability in product/card.php", "details": "SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut_buy parameter.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.3" + }, + { + "fixed": "7.0.4" + } + ] + } + ], + "versions": [ + "7.0.3" + ] + } ], "references": [ { @@ -24,6 +46,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/36402c22eef49d60edd73a2f312f8e28fe0bd1cb" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +57,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:45:11Z", "nvd_published_at": "2018-07-08T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-gw37-vmvw-f833/GHSA-gw37-vmvw-f833.json b/advisories/github-reviewed/2022/05/GHSA-gw37-vmvw-f833/GHSA-gw37-vmvw-f833.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-gw37-vmvw-f833/GHSA-gw37-vmvw-f833.json rename to advisories/github-reviewed/2022/05/GHSA-gw37-vmvw-f833/GHSA-gw37-vmvw-f833.json index 6d1b2359a5a..8fb80e4b0d1 100644 --- a/advisories/unreviewed/2022/05/GHSA-gw37-vmvw-f833/GHSA-gw37-vmvw-f833.json +++ b/advisories/github-reviewed/2022/05/GHSA-gw37-vmvw-f833/GHSA-gw37-vmvw-f833.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-gw37-vmvw-f833", - "modified": "2022-05-17T02:45:41Z", + "modified": "2024-04-24T20:44:13Z", "published": "2022-05-17T02:45:41Z", "aliases": [ "CVE-2017-7886" ], + "summary": "Dolibarr SQL Injection in doli/theme/eldy/style.css.php via the lang parameter", "details": "Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "4.0.4" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7886" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://www.foxmole.com/advisories/foxmole-2017-02-23.txt" @@ -31,8 +44,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:44:13Z", "nvd_published_at": "2017-05-10T14:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-jjqq-m998-53jf/GHSA-jjqq-m998-53jf.json b/advisories/github-reviewed/2022/05/GHSA-jjqq-m998-53jf/GHSA-jjqq-m998-53jf.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-jjqq-m998-53jf/GHSA-jjqq-m998-53jf.json rename to advisories/github-reviewed/2022/05/GHSA-jjqq-m998-53jf/GHSA-jjqq-m998-53jf.json index f0879daecb2..77ce5c0239c 100644 --- a/advisories/unreviewed/2022/05/GHSA-jjqq-m998-53jf/GHSA-jjqq-m998-53jf.json +++ b/advisories/github-reviewed/2022/05/GHSA-jjqq-m998-53jf/GHSA-jjqq-m998-53jf.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-jjqq-m998-53jf", - "modified": "2022-05-14T03:08:16Z", + "modified": "2024-04-24T20:44:58Z", "published": "2022-05-14T03:08:16Z", "aliases": [ "CVE-2018-13447" ], + "summary": "Dolibarr SQL injection vulnerability in product/card.php", "details": "SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.3" + }, + { + "fixed": "7.0.4" + } + ] + } + ], + "versions": [ + "7.0.3" + ] + } ], "references": [ { @@ -24,6 +46,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/36402c22eef49d60edd73a2f312f8e28fe0bd1cb" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +57,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:44:58Z", "nvd_published_at": "2018-07-08T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-m5rg-g6f9-8wpw/GHSA-m5rg-g6f9-8wpw.json b/advisories/github-reviewed/2022/05/GHSA-m5rg-g6f9-8wpw/GHSA-m5rg-g6f9-8wpw.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-m5rg-g6f9-8wpw/GHSA-m5rg-g6f9-8wpw.json rename to advisories/github-reviewed/2022/05/GHSA-m5rg-g6f9-8wpw/GHSA-m5rg-g6f9-8wpw.json index 40cf11b9d07..301b3376ff6 100644 --- a/advisories/unreviewed/2022/05/GHSA-m5rg-g6f9-8wpw/GHSA-m5rg-g6f9-8wpw.json +++ b/advisories/github-reviewed/2022/05/GHSA-m5rg-g6f9-8wpw/GHSA-m5rg-g6f9-8wpw.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-m5rg-g6f9-8wpw", - "modified": "2022-05-14T03:08:35Z", + "modified": "2024-04-24T20:44:47Z", "published": "2022-05-14T03:08:35Z", "aliases": [ "CVE-2018-13448" ], + "summary": "Dolibarr SQL injection vulnerability in product/card.php", "details": "SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the country_id parameter.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.3" + }, + { + "fixed": "7.0.4" + } + ] + } + ], + "versions": [ + "7.0.3" + ] + } ], "references": [ { @@ -24,6 +46,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/36402c22eef49d60edd73a2f312f8e28fe0bd1cb" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +57,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:44:47Z", "nvd_published_at": "2018-07-08T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-qm8m-7626-762h/GHSA-qm8m-7626-762h.json b/advisories/github-reviewed/2022/05/GHSA-qm8m-7626-762h/GHSA-qm8m-7626-762h.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-qm8m-7626-762h/GHSA-qm8m-7626-762h.json rename to advisories/github-reviewed/2022/05/GHSA-qm8m-7626-762h/GHSA-qm8m-7626-762h.json index aad56dc1038..d6f82ea34a5 100644 --- a/advisories/unreviewed/2022/05/GHSA-qm8m-7626-762h/GHSA-qm8m-7626-762h.json +++ b/advisories/github-reviewed/2022/05/GHSA-qm8m-7626-762h/GHSA-qm8m-7626-762h.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-qm8m-7626-762h", - "modified": "2022-05-17T01:05:38Z", + "modified": "2024-04-24T20:44:27Z", "published": "2022-05-17T01:05:38Z", "aliases": [ "CVE-2017-14238" ], + "summary": "Dolibarr SQL injection vulnerability in admin/menus/edit.php", "details": "SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0.1" + } + ] + } + ] + } ], "references": [ { @@ -24,6 +43,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +54,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:44:27Z", "nvd_published_at": "2017-09-11T09:29:00Z" } } \ No newline at end of file