diff --git a/advisories/unreviewed/2022/05/GHSA-6fvw-x6gw-4wv8/GHSA-6fvw-x6gw-4wv8.json b/advisories/github-reviewed/2022/05/GHSA-6fvw-x6gw-4wv8/GHSA-6fvw-x6gw-4wv8.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-6fvw-x6gw-4wv8/GHSA-6fvw-x6gw-4wv8.json rename to advisories/github-reviewed/2022/05/GHSA-6fvw-x6gw-4wv8/GHSA-6fvw-x6gw-4wv8.json index 23d825c58a2..58b3d03f3d0 100644 --- a/advisories/unreviewed/2022/05/GHSA-6fvw-x6gw-4wv8/GHSA-6fvw-x6gw-4wv8.json +++ b/advisories/github-reviewed/2022/05/GHSA-6fvw-x6gw-4wv8/GHSA-6fvw-x6gw-4wv8.json @@ -1,17 +1,42 @@ { "schema_version": "1.4.0", "id": "GHSA-6fvw-x6gw-4wv8", - "modified": "2022-05-24T19:17:16Z", + "modified": "2024-04-25T21:22:44Z", "published": "2022-05-24T19:17:16Z", "aliases": [ "CVE-2021-42325" ], - "details": "Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.", + "summary": "Froxlor SQL injection vulnerability", + "details": "Froxlor through 0.10.29.1 allows SQL injection in `Database/Manager/DbManagerMySQL.php` via a custom DB name.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "froxlor/froxlor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.10.30" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.10.29.1" + } + } ], "references": [ { @@ -22,6 +47,10 @@ "type": "WEB", "url": "https://github.com/Froxlor/Froxlor/commit/eb592340b022298f62a0a3e8450dbfbe29585782" }, + { + "type": "PACKAGE", + "url": "https://github.com/Froxlor/Froxlor" + }, { "type": "WEB", "url": "https://www.exploit-db.com/exploits/50502" @@ -36,8 +65,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:22:44Z", "nvd_published_at": "2021-10-12T20:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-cv24-vh45-4hjm/GHSA-cv24-vh45-4hjm.json b/advisories/github-reviewed/2022/05/GHSA-cv24-vh45-4hjm/GHSA-cv24-vh45-4hjm.json similarity index 60% rename from advisories/unreviewed/2022/05/GHSA-cv24-vh45-4hjm/GHSA-cv24-vh45-4hjm.json rename to advisories/github-reviewed/2022/05/GHSA-cv24-vh45-4hjm/GHSA-cv24-vh45-4hjm.json index 2f7e501957e..c14954e9dfd 100644 --- a/advisories/unreviewed/2022/05/GHSA-cv24-vh45-4hjm/GHSA-cv24-vh45-4hjm.json +++ b/advisories/github-reviewed/2022/05/GHSA-cv24-vh45-4hjm/GHSA-cv24-vh45-4hjm.json @@ -1,23 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-cv24-vh45-4hjm", - "modified": "2022-05-24T19:18:34Z", + "modified": "2024-04-25T21:22:13Z", "published": "2022-05-24T19:18:34Z", "aliases": [ "CVE-2020-28957" ], + "summary": "Foxlor cross-site scripting (XSS) vulnerability", "details": "Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input fields.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "froxlor/froxlor" + }, + "versions": [ + "0.10.16" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28957" }, + { + "type": "PACKAGE", + "url": "https://github.com/Froxlor/Froxlor" + }, { "type": "WEB", "url": "https://www.vulnerability-lab.com/get_content.php?id=2241" @@ -28,8 +44,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:22:13Z", "nvd_published_at": "2021-10-22T20:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-g77v-m226-3f7g/GHSA-g77v-m226-3f7g.json b/advisories/github-reviewed/2022/05/GHSA-g77v-m226-3f7g/GHSA-g77v-m226-3f7g.json similarity index 60% rename from advisories/unreviewed/2022/05/GHSA-g77v-m226-3f7g/GHSA-g77v-m226-3f7g.json rename to advisories/github-reviewed/2022/05/GHSA-g77v-m226-3f7g/GHSA-g77v-m226-3f7g.json index ee9cfb2aee2..ba0454122cf 100644 --- a/advisories/unreviewed/2022/05/GHSA-g77v-m226-3f7g/GHSA-g77v-m226-3f7g.json +++ b/advisories/github-reviewed/2022/05/GHSA-g77v-m226-3f7g/GHSA-g77v-m226-3f7g.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-g77v-m226-3f7g", - "modified": "2022-05-13T01:18:46Z", + "modified": "2024-04-25T21:22:31Z", "published": "2022-05-13T01:18:46Z", "aliases": [ "CVE-2018-1000527" ], + "summary": "Froxlor PHP Object Injection vulnerability", "details": "Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $_POST['ssl_ipandport']. This vulnerability appears to have been fixed in after commit c1e62e6.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "froxlor/froxlor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.9.40" + } + ] + } + ] + } ], "references": [ { @@ -25,9 +44,17 @@ "type": "WEB", "url": "https://github.com/Froxlor/Froxlor/issues/555" }, + { + "type": "WEB", + "url": "https://github.com/Froxlor/Froxlor/commit/c1e62e6be719affc003774a639de5c952ffd8ffc" + }, { "type": "WEB", "url": "https://0dd.zone/2018/05/31/Froxlor-Object-Injection" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Froxlor/Froxlor" } ], "database_specific": { @@ -35,8 +62,8 @@ "CWE-502" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:22:30Z", "nvd_published_at": "2018-06-26T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-qj6h-m7xc-r2v3/GHSA-qj6h-m7xc-r2v3.json b/advisories/github-reviewed/2022/05/GHSA-qj6h-m7xc-r2v3/GHSA-qj6h-m7xc-r2v3.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-qj6h-m7xc-r2v3/GHSA-qj6h-m7xc-r2v3.json rename to advisories/github-reviewed/2022/05/GHSA-qj6h-m7xc-r2v3/GHSA-qj6h-m7xc-r2v3.json index 1aae571b6f5..b4e4440664d 100644 --- a/advisories/unreviewed/2022/05/GHSA-qj6h-m7xc-r2v3/GHSA-qj6h-m7xc-r2v3.json +++ b/advisories/github-reviewed/2022/05/GHSA-qj6h-m7xc-r2v3/GHSA-qj6h-m7xc-r2v3.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-qj6h-m7xc-r2v3", - "modified": "2022-05-17T02:57:53Z", + "modified": "2024-04-25T21:22:15Z", "published": "2022-05-17T02:57:53Z", "aliases": [ "CVE-2016-5100" ], + "summary": "Froxlor guessable password reset token", "details": "Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "froxlor/froxlor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.9.35" + } + ] + } + ] + } ], "references": [ { @@ -24,6 +43,10 @@ { "type": "WEB", "url": "https://github.com/Froxlor/Froxlor/commit/da4ec3e1b591de96675817a009e26e05e848a6ba" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Froxlor/Froxlor" } ], "database_specific": { @@ -31,8 +54,8 @@ "CWE-330" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:22:15Z", "nvd_published_at": "2017-02-13T18:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-r6g8-mq9v-cgp4/GHSA-r6g8-mq9v-cgp4.json b/advisories/github-reviewed/2022/05/GHSA-r6g8-mq9v-cgp4/GHSA-r6g8-mq9v-cgp4.json similarity index 57% rename from advisories/unreviewed/2022/05/GHSA-r6g8-mq9v-cgp4/GHSA-r6g8-mq9v-cgp4.json rename to advisories/github-reviewed/2022/05/GHSA-r6g8-mq9v-cgp4/GHSA-r6g8-mq9v-cgp4.json index 2be40714bda..bfaf874ac2d 100644 --- a/advisories/unreviewed/2022/05/GHSA-r6g8-mq9v-cgp4/GHSA-r6g8-mq9v-cgp4.json +++ b/advisories/github-reviewed/2022/05/GHSA-r6g8-mq9v-cgp4/GHSA-r6g8-mq9v-cgp4.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-r6g8-mq9v-cgp4", - "modified": "2022-05-13T01:49:37Z", + "modified": "2024-04-25T21:22:32Z", "published": "2022-05-13T01:49:37Z", "aliases": [ "CVE-2018-12642" ], + "summary": "Froxlor Incorrect Access Control", "details": "Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "froxlor/froxlor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.9.40" + } + ] + } + ] + } ], "references": [ { @@ -24,6 +43,10 @@ { "type": "WEB", "url": "https://github.com/Froxlor/Froxlor/commit/aa881560cc996c38cbf8c20ee62854e27f72c73c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Froxlor/Froxlor" } ], "database_specific": { @@ -31,8 +54,8 @@ "CWE-732" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:22:32Z", "nvd_published_at": "2018-06-22T12:29:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/10/GHSA-q4qm-fv7m-8rf7/GHSA-q4qm-fv7m-8rf7.json b/advisories/github-reviewed/2022/10/GHSA-q4qm-fv7m-8rf7/GHSA-q4qm-fv7m-8rf7.json new file mode 100644 index 00000000000..5a0f42fe4cd --- /dev/null +++ b/advisories/github-reviewed/2022/10/GHSA-q4qm-fv7m-8rf7/GHSA-q4qm-fv7m-8rf7.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q4qm-fv7m-8rf7", + "modified": "2024-04-25T21:23:17Z", + "published": "2022-10-31T19:00:35Z", + "withdrawn": "2024-04-25T21:23:17Z", + "aliases": [ + "CVE-2022-3772" + ], + "summary": "Duplicate Advisory: Cross-Site Request Forgery in easyii CMS", + "details": "# Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-3x3w-vcjx-7796. This link is maintained to preserve external references.\n\n# Original Description\n\nA vulnerability, which was classified as problematic, was found in easyii CMS. Affected is an unknown function of the file /admin/sign/out. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. VDB-212502 is the identifier assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "noumo/easyii" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3772" + }, + { + "type": "WEB", + "url": "https://github.com/noumo/easyii/issues/222" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-3x3w-vcjx-7796" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.212502" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T21:23:17Z", + "nvd_published_at": "2022-10-31T14:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/10/GHSA-q4qm-fv7m-8rf7/GHSA-q4qm-fv7m-8rf7.json b/advisories/unreviewed/2022/10/GHSA-q4qm-fv7m-8rf7/GHSA-q4qm-fv7m-8rf7.json deleted file mode 100644 index 2fc0afcc471..00000000000 --- a/advisories/unreviewed/2022/10/GHSA-q4qm-fv7m-8rf7/GHSA-q4qm-fv7m-8rf7.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-q4qm-fv7m-8rf7", - "modified": "2022-11-01T19:00:31Z", - "published": "2022-10-31T19:00:35Z", - "aliases": [ - "CVE-2022-3772" - ], - "details": "A vulnerability, which was classified as problematic, was found in easyii CMS. Affected is an unknown function of the file /admin/sign/out. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. VDB-212502 is the identifier assigned to this vulnerability.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3772" - }, - { - "type": "WEB", - "url": "https://github.com/noumo/easyii/issues/222" - }, - { - "type": "WEB", - "url": "https://vuldb.com/?id.212502" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-10-31T14:15:00Z" - } -} \ No newline at end of file