Publish Advisories

GHSA-j4v3-wwwx-5gqv
GHSA-pg82-9w35-3w3r
GHSA-vxcv-4xvf-pc22

advisories/github-reviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-j4v3-wwwx-5gqv",
-  "modified": "2024-11-20T15:30:52Z",
+  "modified": "2024-11-20T18:27:56Z",
   "published": "2024-11-20T12:30:35Z",
   "aliases": [
     "CVE-2024-11404"
   ],
+  "summary": "django Filer Unrestricted Upload of File with Dangerous Type",
   "details": "Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3.3.",
   "severity": [
     {
@@ -14,13 +15,39 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "django-filer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.3.0"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11404"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/django-cms/django-filer/commit/f8209a6507680661bd134cd30878993b79ef3344"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/django-cms/django-filer"
+    },
     {
       "type": "WEB",
       "url": "https://iltosec.com/blog/post/cve-2024-11404-medium-severity-file-upload-vulnerabilities-in-django-filer-323"
@@ -44,11 +71,12 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-20"
+      "CWE-20",
+      "CWE-434"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-11-20T18:27:56Z",
     "nvd_published_at": "2024-11-20T12:15:18Z"
   }
 }

advisories/github-reviewed/2024/11/GHSA-pg82-9w35-3w3r/GHSA-pg82-9w35-3w3r.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-pg82-9w35-3w3r",
-  "modified": "2024-11-15T06:30:33Z",
+  "modified": "2024-11-20T18:29:39Z",
   "published": "2024-11-15T06:30:33Z",
   "aliases": [
     "CVE-2024-39610"
   ],
+  "summary": "FitNesse Cross-site scripting",
   "details": "Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.fitnesse:fitnesse"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20241026"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -25,6 +44,10 @@
       "type": "WEB",
       "url": "https://fitnesse.org/FitNesseDownload"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/unclebob/fitnesse"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/unclebob/fitnesse/releases/tag/20241026"
@@ -39,8 +62,8 @@
       "CWE-79"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-11-20T18:29:39Z",
     "nvd_published_at": "2024-11-15T06:15:04Z"
   }
 }

advisories/github-reviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vxcv-4xvf-pc22",
-  "modified": "2024-11-20T12:30:35Z",
+  "modified": "2024-11-20T18:29:49Z",
   "published": "2024-11-20T12:30:35Z",
   "aliases": [
     "CVE-2024-11406"
   ],
+  "summary": "django CMS Attributes Field Cross-site Scripting",
   "details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.This issue affects django CMS Attributes Fields: before 4.0.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "djangocms-attributes-field"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "4.0.0"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -25,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/django-cms/djangocms-attributes-field/commit/fe68d29ab78db5885bc31b67cf0537f1f02b33ad"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/django-cms/djangocms-attributes-field"
+    },
     {
       "type": "WEB",
       "url": "https://iltosec.com/blog/post/djangocms-attributes-field-300-stored-xss-vulnerability"
@@ -47,8 +70,8 @@
       "CWE-79"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-11-20T18:29:49Z",
     "nvd_published_at": "2024-11-20T12:15:18Z"
   }
 }