From 809391d2478fa9638580ae3001ade5be545c1b3f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 22 Dec 2022 15:31:29 +0000 Subject: [PATCH] Publish Advisories GHSA-6rrr-cv38-85fp GHSA-c8mq-83h4-gm57 GHSA-ff4v-crmx-qh7v GHSA-fmf6-j3g7-995j GHSA-gjfq-92fx-g45f GHSA-hm98-m8vw-mjg2 GHSA-pmj2-vwxv-3w98 GHSA-pvrf-2wf8-jrqv GHSA-q8cm-r6w4-28gm GHSA-r8x7-gmq5-6256 GHSA-vxr5-ghr8-4787 GHSA-w28x-jp4q-gc53 GHSA-w32h-m3r8-mq4c GHSA-x4rq-x9vx-hmx3 GHSA-xxg6-wvf8-73xv --- .../GHSA-6rrr-cv38-85fp.json | 9 ++-- .../GHSA-c8mq-83h4-gm57.json | 11 +++-- .../GHSA-ff4v-crmx-qh7v.json | 11 +++-- .../GHSA-fmf6-j3g7-995j.json | 33 ++++++++++++++ .../GHSA-gjfq-92fx-g45f.json | 36 +++++++++++++++ .../GHSA-hm98-m8vw-mjg2.json | 9 ++-- .../GHSA-pmj2-vwxv-3w98.json | 11 +++-- .../GHSA-pvrf-2wf8-jrqv.json | 11 +++-- .../GHSA-q8cm-r6w4-28gm.json | 11 +++-- .../GHSA-r8x7-gmq5-6256.json | 44 +++++++++++++++++++ .../GHSA-vxr5-ghr8-4787.json | 44 +++++++++++++++++++ .../GHSA-w28x-jp4q-gc53.json | 9 ++-- .../GHSA-w32h-m3r8-mq4c.json | 11 +++-- .../GHSA-x4rq-x9vx-hmx3.json | 9 ++-- .../GHSA-xxg6-wvf8-73xv.json | 9 ++-- 15 files changed, 229 insertions(+), 39 deletions(-) create mode 100644 advisories/unreviewed/2022/12/GHSA-fmf6-j3g7-995j/GHSA-fmf6-j3g7-995j.json create mode 100644 advisories/unreviewed/2022/12/GHSA-gjfq-92fx-g45f/GHSA-gjfq-92fx-g45f.json create mode 100644 advisories/unreviewed/2022/12/GHSA-r8x7-gmq5-6256/GHSA-r8x7-gmq5-6256.json create mode 100644 advisories/unreviewed/2022/12/GHSA-vxr5-ghr8-4787/GHSA-vxr5-ghr8-4787.json diff --git a/advisories/unreviewed/2022/12/GHSA-6rrr-cv38-85fp/GHSA-6rrr-cv38-85fp.json b/advisories/unreviewed/2022/12/GHSA-6rrr-cv38-85fp/GHSA-6rrr-cv38-85fp.json index b12f3e5a14b..57d76747908 100644 --- a/advisories/unreviewed/2022/12/GHSA-6rrr-cv38-85fp/GHSA-6rrr-cv38-85fp.json +++ b/advisories/unreviewed/2022/12/GHSA-6rrr-cv38-85fp/GHSA-6rrr-cv38-85fp.json @@ -1,14 +1,17 @@ { "schema_version": "1.3.0", "id": "GHSA-6rrr-cv38-85fp", - "modified": "2022-12-17T15:30:24Z", + "modified": "2022-12-22T15:30:21Z", "published": "2022-12-17T15:30:24Z", "aliases": [ "CVE-2022-4585" ], "details": "A vulnerability classified as problematic has been found in Opencaching Deutschland oc-server3. This affects an unknown part of the file htdocs/templates2/ocstyle/start.tpl of the component Cookie Handler. The manipulation of the argument usercountryCode leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is c720f2777a452186c67ef30db3679dd409556544. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216171.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -35,7 +38,7 @@ "cwe_ids": [ "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-c8mq-83h4-gm57/GHSA-c8mq-83h4-gm57.json b/advisories/unreviewed/2022/12/GHSA-c8mq-83h4-gm57/GHSA-c8mq-83h4-gm57.json index a44e7d63964..fa2e8fb0c92 100644 --- a/advisories/unreviewed/2022/12/GHSA-c8mq-83h4-gm57/GHSA-c8mq-83h4-gm57.json +++ b/advisories/unreviewed/2022/12/GHSA-c8mq-83h4-gm57/GHSA-c8mq-83h4-gm57.json @@ -1,14 +1,17 @@ { "schema_version": "1.3.0", "id": "GHSA-c8mq-83h4-gm57", - "modified": "2022-12-18T06:31:09Z", + "modified": "2022-12-22T15:30:21Z", "published": "2022-12-18T06:31:09Z", "aliases": [ "CVE-2022-47517" ], "details": "An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-ff4v-crmx-qh7v/GHSA-ff4v-crmx-qh7v.json b/advisories/unreviewed/2022/12/GHSA-ff4v-crmx-qh7v/GHSA-ff4v-crmx-qh7v.json index c3e4dcccdbe..e575129f59f 100644 --- a/advisories/unreviewed/2022/12/GHSA-ff4v-crmx-qh7v/GHSA-ff4v-crmx-qh7v.json +++ b/advisories/unreviewed/2022/12/GHSA-ff4v-crmx-qh7v/GHSA-ff4v-crmx-qh7v.json @@ -1,14 +1,17 @@ { "schema_version": "1.3.0", "id": "GHSA-ff4v-crmx-qh7v", - "modified": "2022-12-18T06:31:09Z", + "modified": "2022-12-22T15:30:20Z", "published": "2022-12-18T06:31:09Z", "aliases": [ "CVE-2022-47518" ], "details": "An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-fmf6-j3g7-995j/GHSA-fmf6-j3g7-995j.json b/advisories/unreviewed/2022/12/GHSA-fmf6-j3g7-995j/GHSA-fmf6-j3g7-995j.json new file mode 100644 index 00000000000..c8aff9982cf --- /dev/null +++ b/advisories/unreviewed/2022/12/GHSA-fmf6-j3g7-995j/GHSA-fmf6-j3g7-995j.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.3.0", + "id": "GHSA-fmf6-j3g7-995j", + "modified": "2022-12-22T15:30:21Z", + "published": "2022-12-22T15:30:21Z", + "aliases": [ + "CVE-2022-45966" + ], + "details": "here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45966" + }, + { + "type": "WEB", + "url": "https://github.com/yinfei6/classcms" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-gjfq-92fx-g45f/GHSA-gjfq-92fx-g45f.json b/advisories/unreviewed/2022/12/GHSA-gjfq-92fx-g45f/GHSA-gjfq-92fx-g45f.json new file mode 100644 index 00000000000..20a922e992b --- /dev/null +++ b/advisories/unreviewed/2022/12/GHSA-gjfq-92fx-g45f/GHSA-gjfq-92fx-g45f.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.3.0", + "id": "GHSA-gjfq-92fx-g45f", + "modified": "2022-12-22T15:30:22Z", + "published": "2022-12-22T15:30:22Z", + "aliases": [ + "CVE-2022-41992" + ], + "details": "A memory corruption vulnerability exists in the VHD File Format parsing CXSPARSE record functionality of PowerISO PowerISO 8.3. A specially-crafted file can lead to an out-of-bounds write. A victim needs to open a malicious file to trigger this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41992" + }, + { + "type": "WEB", + "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1644" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": false + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-hm98-m8vw-mjg2/GHSA-hm98-m8vw-mjg2.json b/advisories/unreviewed/2022/12/GHSA-hm98-m8vw-mjg2/GHSA-hm98-m8vw-mjg2.json index f086c7d9f8b..b8afe1facac 100644 --- a/advisories/unreviewed/2022/12/GHSA-hm98-m8vw-mjg2/GHSA-hm98-m8vw-mjg2.json +++ b/advisories/unreviewed/2022/12/GHSA-hm98-m8vw-mjg2/GHSA-hm98-m8vw-mjg2.json @@ -1,14 +1,17 @@ { "schema_version": "1.3.0", "id": "GHSA-hm98-m8vw-mjg2", - "modified": "2022-12-17T15:30:24Z", + "modified": "2022-12-22T15:30:21Z", "published": "2022-12-17T15:30:24Z", "aliases": [ "CVE-2022-4581" ], "details": "A vulnerability was found in 1j01 mind-map and classified as problematic. This issue affects some unknown processing of the file app.coffee. The manipulation of the argument html leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9617e6084dfeccd92079ab4d7f439300a4b24394. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216167.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-pmj2-vwxv-3w98/GHSA-pmj2-vwxv-3w98.json b/advisories/unreviewed/2022/12/GHSA-pmj2-vwxv-3w98/GHSA-pmj2-vwxv-3w98.json index fbb0347e830..b654075b33e 100644 --- a/advisories/unreviewed/2022/12/GHSA-pmj2-vwxv-3w98/GHSA-pmj2-vwxv-3w98.json +++ b/advisories/unreviewed/2022/12/GHSA-pmj2-vwxv-3w98/GHSA-pmj2-vwxv-3w98.json @@ -1,14 +1,17 @@ { "schema_version": "1.3.0", "id": "GHSA-pmj2-vwxv-3w98", - "modified": "2022-12-18T06:31:09Z", + "modified": "2022-12-22T15:30:21Z", "published": "2022-12-18T06:31:09Z", "aliases": [ "CVE-2022-47520" ], "details": "An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-125" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-pvrf-2wf8-jrqv/GHSA-pvrf-2wf8-jrqv.json b/advisories/unreviewed/2022/12/GHSA-pvrf-2wf8-jrqv/GHSA-pvrf-2wf8-jrqv.json index 193ff4679b2..379b2845bcb 100644 --- a/advisories/unreviewed/2022/12/GHSA-pvrf-2wf8-jrqv/GHSA-pvrf-2wf8-jrqv.json +++ b/advisories/unreviewed/2022/12/GHSA-pvrf-2wf8-jrqv/GHSA-pvrf-2wf8-jrqv.json @@ -1,14 +1,17 @@ { "schema_version": "1.3.0", "id": "GHSA-pvrf-2wf8-jrqv", - "modified": "2022-12-18T06:31:09Z", + "modified": "2022-12-22T15:30:21Z", "published": "2022-12-18T06:31:09Z", "aliases": [ "CVE-2022-47519" ], "details": "An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-q8cm-r6w4-28gm/GHSA-q8cm-r6w4-28gm.json b/advisories/unreviewed/2022/12/GHSA-q8cm-r6w4-28gm/GHSA-q8cm-r6w4-28gm.json index e6dd2b49a40..87c097d77c5 100644 --- a/advisories/unreviewed/2022/12/GHSA-q8cm-r6w4-28gm/GHSA-q8cm-r6w4-28gm.json +++ b/advisories/unreviewed/2022/12/GHSA-q8cm-r6w4-28gm/GHSA-q8cm-r6w4-28gm.json @@ -1,14 +1,17 @@ { "schema_version": "1.3.0", "id": "GHSA-q8cm-r6w4-28gm", - "modified": "2022-12-18T06:31:08Z", + "modified": "2022-12-22T15:30:21Z", "published": "2022-12-18T06:31:08Z", "aliases": [ "CVE-2022-47521" ], "details": "An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-r8x7-gmq5-6256/GHSA-r8x7-gmq5-6256.json b/advisories/unreviewed/2022/12/GHSA-r8x7-gmq5-6256/GHSA-r8x7-gmq5-6256.json new file mode 100644 index 00000000000..9cc225692d0 --- /dev/null +++ b/advisories/unreviewed/2022/12/GHSA-r8x7-gmq5-6256/GHSA-r8x7-gmq5-6256.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.3.0", + "id": "GHSA-r8x7-gmq5-6256", + "modified": "2022-12-22T15:30:21Z", + "published": "2022-12-22T15:30:21Z", + "aliases": [ + "CVE-2022-4558" + ], + "details": "A vulnerability was found in Alinto SOGo up to 5.7.1. It has been classified as problematic. This affects an unknown part of the file SoObjects/SOGo/NSString+Utilities.m of the component Folder/Mail Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is 1e0f5f00890f751e84d67be4f139dd7f00faa5f3. It is recommended to upgrade the affected component. The identifier VDB-215961 was assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4558" + }, + { + "type": "WEB", + "url": "https://github.com/Alinto/sogo/commit/1e0f5f00890f751e84d67be4f139dd7f00faa5f3" + }, + { + "type": "WEB", + "url": "https://github.com/Alinto/sogo/releases/tag/SOGo-5.8.0" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.215961" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-vxr5-ghr8-4787/GHSA-vxr5-ghr8-4787.json b/advisories/unreviewed/2022/12/GHSA-vxr5-ghr8-4787/GHSA-vxr5-ghr8-4787.json new file mode 100644 index 00000000000..9918884f4e0 --- /dev/null +++ b/advisories/unreviewed/2022/12/GHSA-vxr5-ghr8-4787/GHSA-vxr5-ghr8-4787.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.3.0", + "id": "GHSA-vxr5-ghr8-4787", + "modified": "2022-12-22T15:30:22Z", + "published": "2022-12-22T15:30:22Z", + "aliases": [ + "CVE-2022-4556" + ], + "details": "A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting. The attack may be launched remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is efac49ae91a4a325df9931e78e543f707a0f8e5e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215960.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4556" + }, + { + "type": "WEB", + "url": "https://github.com/Alinto/sogo/commit/efac49ae91a4a325df9931e78e543f707a0f8e5e" + }, + { + "type": "WEB", + "url": "https://github.com/Alinto/sogo/releases/tag/SOGo-5.8.0" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.215960" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-w28x-jp4q-gc53/GHSA-w28x-jp4q-gc53.json b/advisories/unreviewed/2022/12/GHSA-w28x-jp4q-gc53/GHSA-w28x-jp4q-gc53.json index eb5dea25cb8..ec9ff4f1158 100644 --- a/advisories/unreviewed/2022/12/GHSA-w28x-jp4q-gc53/GHSA-w28x-jp4q-gc53.json +++ b/advisories/unreviewed/2022/12/GHSA-w28x-jp4q-gc53/GHSA-w28x-jp4q-gc53.json @@ -1,14 +1,17 @@ { "schema_version": "1.3.0", "id": "GHSA-w28x-jp4q-gc53", - "modified": "2022-12-17T15:30:24Z", + "modified": "2022-12-22T15:30:21Z", "published": "2022-12-17T15:30:24Z", "aliases": [ "CVE-2022-4584" ], "details": "A vulnerability was found in Axiomatic Bento4. It has been rated as critical. Affected by this issue is some unknown functionality of the component mp42aac. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-216170 is the identifier assigned to this vulnerability.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -35,7 +38,7 @@ "cwe_ids": [ "CWE-119" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-w32h-m3r8-mq4c/GHSA-w32h-m3r8-mq4c.json b/advisories/unreviewed/2022/12/GHSA-w32h-m3r8-mq4c/GHSA-w32h-m3r8-mq4c.json index 6d8f66db87e..8366ddf5e34 100644 --- a/advisories/unreviewed/2022/12/GHSA-w32h-m3r8-mq4c/GHSA-w32h-m3r8-mq4c.json +++ b/advisories/unreviewed/2022/12/GHSA-w32h-m3r8-mq4c/GHSA-w32h-m3r8-mq4c.json @@ -1,14 +1,17 @@ { "schema_version": "1.3.0", "id": "GHSA-w32h-m3r8-mq4c", - "modified": "2022-12-18T06:31:09Z", + "modified": "2022-12-22T15:30:21Z", "published": "2022-12-18T06:31:09Z", "aliases": [ "CVE-2022-47516" ], "details": "An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that leads to a failure of the libsofia-sip-ua/tport/tport.c self assertion.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-617" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-x4rq-x9vx-hmx3/GHSA-x4rq-x9vx-hmx3.json b/advisories/unreviewed/2022/12/GHSA-x4rq-x9vx-hmx3/GHSA-x4rq-x9vx-hmx3.json index ce6da9b916a..df7c3013af4 100644 --- a/advisories/unreviewed/2022/12/GHSA-x4rq-x9vx-hmx3/GHSA-x4rq-x9vx-hmx3.json +++ b/advisories/unreviewed/2022/12/GHSA-x4rq-x9vx-hmx3/GHSA-x4rq-x9vx-hmx3.json @@ -1,14 +1,17 @@ { "schema_version": "1.3.0", "id": "GHSA-x4rq-x9vx-hmx3", - "modified": "2022-12-17T15:30:24Z", + "modified": "2022-12-22T15:30:21Z", "published": "2022-12-17T15:30:24Z", "aliases": [ "CVE-2022-4586" ], "details": "A vulnerability classified as problematic was found in Opencaching Deutschland oc-server3. This vulnerability affects unknown code of the file htdocs/templates2/ocstyle/cachelists.tpl of the component Cachelist Handler. The manipulation of the argument name_filter/by_filter leads to cross site scripting. The attack can be initiated remotely. The name of the patch is a9f79c7da78cd24a7ef1d298e6bc86006972ea73. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216172.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -35,7 +38,7 @@ "cwe_ids": [ "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-xxg6-wvf8-73xv/GHSA-xxg6-wvf8-73xv.json b/advisories/unreviewed/2022/12/GHSA-xxg6-wvf8-73xv/GHSA-xxg6-wvf8-73xv.json index 50dd05bc2a8..2b190f15d4b 100644 --- a/advisories/unreviewed/2022/12/GHSA-xxg6-wvf8-73xv/GHSA-xxg6-wvf8-73xv.json +++ b/advisories/unreviewed/2022/12/GHSA-xxg6-wvf8-73xv/GHSA-xxg6-wvf8-73xv.json @@ -1,14 +1,17 @@ { "schema_version": "1.3.0", "id": "GHSA-xxg6-wvf8-73xv", - "modified": "2022-12-17T15:30:24Z", + "modified": "2022-12-22T15:30:21Z", "published": "2022-12-17T15:30:24Z", "aliases": [ "CVE-2022-4582" ], "details": "A vulnerability was found in starter-public-edition-4 up to 4.6.10. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 4.6.11 is able to address this issue. The name of the patch is 2606983c20f6ea3430ac4b36b3d2e88aafef45da. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216168.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -35,7 +38,7 @@ "cwe_ids": [ "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false } } \ No newline at end of file