From 7cf4fa8c3cadbec4d7b7897fd220b25df8e0d98d Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Sat, 12 Apr 2025 03:14:21 +0000 Subject: [PATCH] Publish Advisories GHSA-c5x3-gq36-prrp GHSA-rg6g-v4xm-g49q GHSA-c5x3-gq36-prrp GHSA-rg6g-v4xm-g49q --- .../GHSA-c5x3-gq36-prrp.json | 69 +++++++++++++++++++ .../GHSA-rg6g-v4xm-g49q.json | 69 +++++++++++++++++++ .../GHSA-c5x3-gq36-prrp.json | 43 ------------ .../GHSA-rg6g-v4xm-g49q.json | 43 ------------ 4 files changed, 138 insertions(+), 86 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-c5x3-gq36-prrp/GHSA-c5x3-gq36-prrp.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-rg6g-v4xm-g49q/GHSA-rg6g-v4xm-g49q.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-c5x3-gq36-prrp/GHSA-c5x3-gq36-prrp.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-rg6g-v4xm-g49q/GHSA-rg6g-v4xm-g49q.json diff --git a/advisories/github-reviewed/2022/05/GHSA-c5x3-gq36-prrp/GHSA-c5x3-gq36-prrp.json b/advisories/github-reviewed/2022/05/GHSA-c5x3-gq36-prrp/GHSA-c5x3-gq36-prrp.json new file mode 100644 index 00000000000..db39f2380aa --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-c5x3-gq36-prrp/GHSA-c5x3-gq36-prrp.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c5x3-gq36-prrp", + "modified": "2025-04-12T03:12:48Z", + "published": "2022-05-13T01:29:03Z", + "aliases": [ + "CVE-2013-4744" + ], + "summary": "PHPUnit extension for TYPO3 vulnerable to Cross-site Scripting", + "details": "Cross-site scripting (XSS) vulnerability in the PHPUnit extension before 3.5.15 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "oliverklee/phpunit" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.5.15" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4744" + }, + { + "type": "WEB", + "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81194" + }, + { + "type": "PACKAGE", + "url": "https://github.com/oliverklee/ext-phpunit" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20130129050219/http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-001" + }, + { + "type": "WEB", + "url": "http://typo3.org/extensions/repository/view/phpunit" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T03:12:48Z", + "nvd_published_at": "2013-07-01T21:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-rg6g-v4xm-g49q/GHSA-rg6g-v4xm-g49q.json b/advisories/github-reviewed/2022/05/GHSA-rg6g-v4xm-g49q/GHSA-rg6g-v4xm-g49q.json new file mode 100644 index 00000000000..36207988c80 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-rg6g-v4xm-g49q/GHSA-rg6g-v4xm-g49q.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rg6g-v4xm-g49q", + "modified": "2025-04-12T03:13:23Z", + "published": "2022-05-17T01:33:01Z", + "aliases": [ + "CVE-2013-4748" + ], + "summary": "News system (news) extension for TYPO3 vulnerable to SQL Injection", + "details": "SQL injection vulnerability in the News system (news) extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "georgringer/news" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.3.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4748" + }, + { + "type": "WEB", + "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81192" + }, + { + "type": "PACKAGE", + "url": "https://github.com/georgringer/news" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20130214093535/http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-001" + }, + { + "type": "WEB", + "url": "http://typo3.org/extensions/repository/view/news" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T03:13:23Z", + "nvd_published_at": "2013-07-01T23:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-c5x3-gq36-prrp/GHSA-c5x3-gq36-prrp.json b/advisories/unreviewed/2022/05/GHSA-c5x3-gq36-prrp/GHSA-c5x3-gq36-prrp.json deleted file mode 100644 index 0377399026c..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-c5x3-gq36-prrp/GHSA-c5x3-gq36-prrp.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-c5x3-gq36-prrp", - "modified": "2025-04-11T04:11:32Z", - "published": "2022-05-13T01:29:03Z", - "aliases": [ - "CVE-2013-4744" - ], - "details": "Cross-site scripting (XSS) vulnerability in the PHPUnit extension before 3.5.15 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4744" - }, - { - "type": "WEB", - "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81194" - }, - { - "type": "WEB", - "url": "http://osvdb.org/89132" - }, - { - "type": "WEB", - "url": "http://typo3.org/extensions/repository/view/phpunit" - }, - { - "type": "WEB", - "url": "http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-001" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2013-07-01T21:55:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-rg6g-v4xm-g49q/GHSA-rg6g-v4xm-g49q.json b/advisories/unreviewed/2022/05/GHSA-rg6g-v4xm-g49q/GHSA-rg6g-v4xm-g49q.json deleted file mode 100644 index 4b44a06dfa5..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-rg6g-v4xm-g49q/GHSA-rg6g-v4xm-g49q.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-rg6g-v4xm-g49q", - "modified": "2025-04-11T04:11:32Z", - "published": "2022-05-17T01:33:01Z", - "aliases": [ - "CVE-2013-4748" - ], - "details": "SQL injection vulnerability in the News system (news) extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4748" - }, - { - "type": "WEB", - "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81192" - }, - { - "type": "WEB", - "url": "http://osvdb.org/89134" - }, - { - "type": "WEB", - "url": "http://typo3.org/extensions/repository/view/news" - }, - { - "type": "WEB", - "url": "http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-001" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-89" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2013-07-01T23:55:00Z" - } -} \ No newline at end of file