Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2022-07-28 00:34:22 +00:00
parent 1918310ade
commit 7cdf84a41d
296 changed files with 5780 additions and 806 deletions
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-9wxh-jjj5-67cv",
+  "modified": "2022-07-27T21:24:04Z",
+  "published": "2022-01-13T00:00:58Z",
+  "aliases": [
+    "CVE-2022-20620"
+  ],
+  "summary": "Missing permission checks in SSH Agent Plugin allow enumerating credentials IDs",
+  "details": "Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allow attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. An enumeration of credentials IDs in SSH Agent Plugin 1.23.2 requires the appropriate permissions.\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:ssh-agent"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.23.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20620"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2189"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2022/01/12/6"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/jenkinsci/ssh-agent-plugin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-668"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true
+  }
+}
@@ -0,0 +1,59 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-5m8f-v3gw-h94w",
+  "modified": "2022-07-27T21:24:40Z",
+  "published": "2022-02-16T00:01:28Z",
+  "aliases": [
+    "CVE-2022-25187"
+  ],
+  "summary": "Support Core Plugin before 2.79.1 stores sensitive data in plain text",
+  "details": "Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle. Support Core Plugin 2.79.1 adds a list of keywords whose associated values are redacted.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:support-core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.79.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25187"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2186"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/jenkinsci/support-core-plugin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-522"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true
+  }
+}
@@ -1,11 +1,12 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-9772-cwx9-r4cj",
-  "modified": "2022-05-14T02:05:09Z",
+  "modified": "2022-07-27T21:35:21Z",
  "published": "2022-05-14T02:05:09Z",
  "aliases": [
    "CVE-2014-4616"
  ],
+  "summary": "simplejson before 2.6.1 vulnerable to array index error",
  "details": "Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.",
  "severity": [
    {
@@ -14,7 +15,25 @@
    }
  ],
  "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "simplejson"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.6.1"
+            }
+          ]
+        }
+      ]
+    }
  ],
  "references": [
    {
@@ -56,14 +75,17 @@
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/68119"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/simplejson/simplejson"
    }
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-119",
      "CWE-129"
    ],
    "severity": "MODERATE",
-    "github_reviewed": false
+    "github_reviewed": true
  }
 }
@@ -0,0 +1,82 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-cv78-v957-jx34",
+  "modified": "2022-07-27T22:17:45Z",
+  "published": "2022-05-24T17:12:57Z",
+  "aliases": [
+    "CVE-2020-7599"
+  ],
+  "summary": "Exposure of Sensitive Information in Gradle publish plugin",
+  "details": "All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is publicly visible (as it is in many popular public CI systems like TravisCI) this AWS pre-signed URL would allow a malicious actor to replace a recently uploaded plugin with their own.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.gradle.publish:plugin-publish-plugin"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.11.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.11.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7599"
+    },
+    {
+      "type": "WEB",
+      "url": "https://blog.gradle.org/plugin-portal-update"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.gradle.org/plugin/com.gradle.plugin-publish"
+    },
+    {
+      "type": "WEB",
+      "url": "https://snyk.io/vuln/SNYK-JAVA-COMGRADLEPLUGINPUBLISH-559866"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-532"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true
+  }
+}
@@ -0,0 +1,74 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-gwf7-vfjf-wf6x",
+  "modified": "2022-07-27T21:34:46Z",
+  "published": "2022-05-24T16:45:24Z",
+  "aliases": [
+    "CVE-2019-11842"
+  ],
+  "summary": "matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG",
+  "details": "An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "matrix-sydent"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.0.3"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "matrix-synapse"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.99.3.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11842"
+    },
+    {
+      "type": "WEB",
+      "url": "https://matrix.org/blog/2019/05/03/security-updates-sydent-1-0-3-synapse-0-99-3-1-and-riot-android-0-9-0-0-8-99-0-8-28-a/"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-338"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true
+  }
+}
@@ -1,11 +1,12 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-qh9x-mc42-vg4g",
-  "modified": "2022-05-14T03:32:28Z",
+  "modified": "2022-07-27T21:33:52Z",
  "published": "2022-05-14T03:32:28Z",
  "aliases": [
    "CVE-2018-1000089"
  ],
+  "summary": "django-anymail Includes Sensitive Information in Log Files",
  "details": "Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your Django error reports, an attacker could discover your ANYMAIL_WEBHOOK setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app. This vulnerability appears to have been fixed in v1.4.",
  "severity": [
    {
@@ -14,7 +15,25 @@
    }
  ],
  "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "django-anymail"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.2"
+            },
+            {
+              "fixed": "1.4"
+            }
+          ]
+        }
+      ]
+    }
  ],
  "references": [
    {
@@ -28,6 +47,10 @@
    {
      "type": "WEB",
      "url": "https://github.com/anymail/django-anymail/releases/tag/v1.4"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/anymail/django-anymail"
    }
  ],
  "database_specific": {
@@ -35,6 +58,6 @@
      "CWE-532"
    ],
    "severity": "HIGH",
-    "github_reviewed": false
+    "github_reviewed": true
  }
 }
@@ -1,17 +1,36 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-v64w-96p6-fx7w",
-  "modified": "2022-05-17T04:48:11Z",
+  "modified": "2022-07-27T21:38:21Z",
  "published": "2022-05-17T04:48:11Z",
  "aliases": [
    "CVE-2013-1777"
  ],
+  "summary": "Apache Geronimo JMX Remoting functionality allows remote code execution in 3.x before v3.0.1",
  "details": "The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.",
  "severity": [

  ],
  "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.apache.geronimo.framework:geronimo-jmx-remoting"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.0-beta-1"
+            },
+            {
+              "fixed": "3.0.1"
+            }
+          ]
+        }
+      ]
+    }
  ],
  "references": [
    {
@@ -30,6 +49,14 @@
      "type": "WEB",
      "url": "http://geronimo.apache.org/30x-security-report.html"
    },
+    {
+      "type": "WEB",
+      "url": "http://svn.apache.org/viewvc/geronimo/server/trunk"
+    },
+    {
+      "type": "WEB",
+      "url": "http://svn.apache.org/viewvc?view=revision&revision=1458113"
+    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21643282"
@@ -40,6 +67,6 @@
      "CWE-94"
    ],
    "severity": "HIGH",
-    "github_reviewed": false
+    "github_reviewed": true
  }
 }
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-5469-c5p2-xv5g",
+  "modified": "2022-07-27T22:10:26Z",
+  "published": "2022-07-23T00:00:15Z",
+  "aliases": [
+    "CVE-2022-34113"
+  ],
+  "summary": "Dataease before 1.11.2 allows arbitrary code execution via crafter plugin",
+  "details": "An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. Version 1.11.2 contains a patch for the problem.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "io.dataease:dataease-plugin-common"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.11.2"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 1.11.1"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34113"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/dataease/dataease/issues/2431"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/dataease/dataease/releases/tag/v1.11.2"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/dataease/dataease"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true
+  }
+}
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-5834-xv5q-cgfw",
+  "modified": "2022-07-27T22:06:09Z",
+  "published": "2022-07-27T22:06:09Z",
+  "aliases": [
+    "CVE-2022-31148"
+  ],
+  "summary": "Shopware vulnerable to persistent XSS in customer module",
+  "details": "### Impact\nPersistent XSS in customer module\n\n### Patches\n\nWe recommend updating to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview.\n\nFor older versions you can use the Security Plugin:\nhttps://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html\n\n### References\nhttps://docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "shopware/shopware"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "5.7.0"
+            },
+            {
+              "fixed": "5.7.14"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 5.7.13"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/shopware/shopware/security/advisories/GHSA-5834-xv5q-cgfw"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.shopware.com/en/changelog-sw5/#5-7-14"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/shopware/shopware"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true
+  }
+}
@@ -0,0 +1,67 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-c2pj-rr68-pw94",
+  "modified": "2022-07-27T22:10:40Z",
+  "published": "2022-07-23T00:00:15Z",
+  "aliases": [
+    "CVE-2022-34112"
+  ],
+  "summary": "Dataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin",
+  "details": "An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator. Version 1.11.2 contains a patch for this issue.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "io.dataease:dataease-plugin-common"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.11.2"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 1.11.1"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34112"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/dataease/dataease/issues/2429"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/dataease/dataease/commit/5f611d3e3934816e9ad34e3d21807978001e2c8b"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/dataease/dataease/releases/tag/v1.11.2"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/dataease/dataease"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true
+  }
+}
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-cfcg-2qgr-v243",
+  "modified": "2022-07-27T22:11:04Z",
+  "published": "2022-07-23T00:00:22Z",
+  "aliases": [
+    "CVE-2022-2470"
+  ],
+  "summary": "Microweber before 1.2.21 vulnerable to reflected XSS",
+  "details": "Microweber prior to 1.2.21 is vulnerable to reflected cross-site scripting (XSS).",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "microweber/microweber"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.2.21"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2470"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/microweber/microweber/commit/d28655183800b833abb20ccd55e1628f16ff65e4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://huntr.dev/bounties/3f1f679c-c243-431c-8ed0-e61543b9921b"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/microweber/microweber"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true
+  }
+}
@@ -0,0 +1,60 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-m7gr-5w5g-36jf",
+  "modified": "2022-07-27T22:12:07Z",
+  "published": "2022-07-23T00:00:22Z",
+  "aliases": [
+    "CVE-2022-34037"
+  ],
+  "summary": "Out-of-bounds Read can lead to client side denial of service",
+  "details": "An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) on the client side via a crafted URI.\n\nAccording to the maintainer, the bug only affects the client side of the request and cannot cause a denial of service on the server.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/caddyserver/caddy"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.5.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34037"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/caddyserver/caddy/issues/4775"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/caddyserver/caddy/commit/693e9b5283e675b56084ecc83d73176cab0ee27c"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/caddyserver/caddy"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-125"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true
+  }
+}
@@ -1,37 +0,0 @@
-{
-  "schema_version": "1.2.0",
-  "id": "GHSA-9wxh-jjj5-67cv",
-  "modified": "2022-01-19T00:01:36Z",
-  "published": "2022-01-13T00:00:58Z",
-  "aliases": [
-    "CVE-2022-20620"
-  ],
-  "details": "Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20620"
-    },
-    {
-      "type": "WEB",
-      "url": "https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2189"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.openwall.com/lists/oss-security/2022/01/12/6"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-668"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false
-  }
-}
@@ -1,33 +0,0 @@
-{
-  "schema_version": "1.2.0",
-  "id": "GHSA-5m8f-v3gw-h94w",
-  "modified": "2022-02-24T00:01:05Z",
-  "published": "2022-02-16T00:01:28Z",
-  "aliases": [
-    "CVE-2022-25187"
-  ],
-  "details": "Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25187"
-    },
-    {
-      "type": "WEB",
-      "url": "https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2186"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-522"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false
-  }
-}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-mcpv-3q7c-v7rr",
-  "modified": "2022-02-11T00:01:09Z",
+  "modified": "2022-07-28T00:00:48Z",
  "published": "2022-02-08T00:00:30Z",
  "aliases": [
    "CVE-2022-23184"
  ],
  "details": "In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -24,6 +24,10 @@
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1512"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1512"
    }
  ],
  "database_specific": {
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-48rh-rw8j-qvqv",
-  "modified": "2022-05-24T16:54:40Z",
+  "modified": "2022-07-28T00:00:46Z",
  "published": "2022-05-24T16:54:40Z",
  "aliases": [
    "CVE-2019-15507"
  ],
  "details": "In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.7. The fix was back-ported to LTS 2019.6.7 as well as LTS 2019.3.8.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-5fjw-573q-gg89",
-  "modified": "2022-05-24T16:54:40Z",
+  "modified": "2022-07-28T00:00:46Z",
  "published": "2022-05-24T16:54:40Z",
  "aliases": [
    "CVE-2019-15508"
  ],
  "details": "In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The fix was back-ported to 4.0.7.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [
      "CWE-532"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false
  }
 }
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-5m64-chxv-wxq3",
-  "modified": "2022-05-24T17:39:28Z",
+  "modified": "2022-07-28T00:00:49Z",
  "published": "2022-05-24T17:39:28Z",
  "aliases": [
    "CVE-2020-29450"
  ],
  "details": "Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the avatar upload feature. The affected versions are before version 7.2.0.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

--- a/Show More
+++ b/Show More