diff --git a/advisories/unreviewed/2022/05/GHSA-5x4j-xcmv-v3q2/GHSA-5x4j-xcmv-v3q2.json b/advisories/github-reviewed/2022/05/GHSA-5x4j-xcmv-v3q2/GHSA-5x4j-xcmv-v3q2.json similarity index 65% rename from advisories/unreviewed/2022/05/GHSA-5x4j-xcmv-v3q2/GHSA-5x4j-xcmv-v3q2.json rename to advisories/github-reviewed/2022/05/GHSA-5x4j-xcmv-v3q2/GHSA-5x4j-xcmv-v3q2.json index f21138f315e..71f1568867f 100644 --- a/advisories/unreviewed/2022/05/GHSA-5x4j-xcmv-v3q2/GHSA-5x4j-xcmv-v3q2.json +++ b/advisories/github-reviewed/2022/05/GHSA-5x4j-xcmv-v3q2/GHSA-5x4j-xcmv-v3q2.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-5x4j-xcmv-v3q2", - "modified": "2022-05-13T01:47:44Z", + "modified": "2024-04-24T20:47:30Z", "published": "2022-05-13T01:47:44Z", "aliases": [ "CVE-2017-8879" ], + "summary": "Dolibarr allows password changes without supplying the current password", "details": "Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "4.0.4" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8879" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://www.foxmole.com/advisories/foxmole-2017-02-23.txt" @@ -31,8 +44,8 @@ "CWE-287" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:47:30Z", "nvd_published_at": "2017-05-10T14:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-6j62-m2vv-wc3m/GHSA-6j62-m2vv-wc3m.json b/advisories/github-reviewed/2022/05/GHSA-6j62-m2vv-wc3m/GHSA-6j62-m2vv-wc3m.json similarity index 68% rename from advisories/unreviewed/2022/05/GHSA-6j62-m2vv-wc3m/GHSA-6j62-m2vv-wc3m.json rename to advisories/github-reviewed/2022/05/GHSA-6j62-m2vv-wc3m/GHSA-6j62-m2vv-wc3m.json index 1ce607a925e..8e9d9f9b78e 100644 --- a/advisories/unreviewed/2022/05/GHSA-6j62-m2vv-wc3m/GHSA-6j62-m2vv-wc3m.json +++ b/advisories/github-reviewed/2022/05/GHSA-6j62-m2vv-wc3m/GHSA-6j62-m2vv-wc3m.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-6j62-m2vv-wc3m", - "modified": "2022-05-13T01:18:47Z", + "modified": "2024-04-24T20:47:40Z", "published": "2022-05-13T01:18:47Z", "aliases": [ "CVE-2018-10092" ], + "summary": "Dolibarr arbitrary commands execution", "details": "The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.0.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/5d121b2d3ae2a95abebc9dc31e4782cbc61a1f39" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog" @@ -43,8 +66,8 @@ "CWE-862" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:47:40Z", "nvd_published_at": "2018-05-22T20:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-fff9-m6f6-q3mh/GHSA-fff9-m6f6-q3mh.json b/advisories/github-reviewed/2022/05/GHSA-fff9-m6f6-q3mh/GHSA-fff9-m6f6-q3mh.json similarity index 67% rename from advisories/unreviewed/2022/05/GHSA-fff9-m6f6-q3mh/GHSA-fff9-m6f6-q3mh.json rename to advisories/github-reviewed/2022/05/GHSA-fff9-m6f6-q3mh/GHSA-fff9-m6f6-q3mh.json index 119d7fcb61a..50f74bd662a 100644 --- a/advisories/unreviewed/2022/05/GHSA-fff9-m6f6-q3mh/GHSA-fff9-m6f6-q3mh.json +++ b/advisories/github-reviewed/2022/05/GHSA-fff9-m6f6-q3mh/GHSA-fff9-m6f6-q3mh.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fff9-m6f6-q3mh", - "modified": "2022-05-13T01:11:52Z", + "modified": "2024-04-24T20:47:56Z", "published": "2022-05-13T01:11:52Z", "aliases": [ "CVE-2018-9019" ], + "summary": "Dolibarr SQL Injection vulnerability", "details": "SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categories_list.php, /accountancy/admin/journals_list.php, /admin/dict.php, /admin/mails_templates.php, or /admin/website.php.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.0.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/83b762b681c6dfdceb809d26ce95f3667b614739" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog" @@ -39,8 +62,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:47:56Z", "nvd_published_at": "2018-05-22T20:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-r3r5-fqfm-9wrh/GHSA-r3r5-fqfm-9wrh.json b/advisories/github-reviewed/2022/05/GHSA-r3r5-fqfm-9wrh/GHSA-r3r5-fqfm-9wrh.json similarity index 54% rename from advisories/unreviewed/2022/05/GHSA-r3r5-fqfm-9wrh/GHSA-r3r5-fqfm-9wrh.json rename to advisories/github-reviewed/2022/05/GHSA-r3r5-fqfm-9wrh/GHSA-r3r5-fqfm-9wrh.json index 5feeb244ac1..bb4139d763d 100644 --- a/advisories/unreviewed/2022/05/GHSA-r3r5-fqfm-9wrh/GHSA-r3r5-fqfm-9wrh.json +++ b/advisories/github-reviewed/2022/05/GHSA-r3r5-fqfm-9wrh/GHSA-r3r5-fqfm-9wrh.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-r3r5-fqfm-9wrh", - "modified": "2022-05-14T01:27:14Z", + "modified": "2024-04-24T20:47:24Z", "published": "2022-05-14T01:27:14Z", "aliases": [ "CVE-2018-16808" ], + "summary": "Dolibarr Stored Cross-site Scripting in expensereport/card.php", "details": "An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.0.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 7.0.0" + } + } ], "references": [ { @@ -24,6 +46,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/issues/9449" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +57,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:47:24Z", "nvd_published_at": "2019-03-07T23:29:00Z" } } \ No newline at end of file