diff --git a/advisories/unreviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json b/advisories/github-reviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json similarity index 65% rename from advisories/unreviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json rename to advisories/github-reviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json index 7707a8de38d..9ac2a2a3274 100644 --- a/advisories/unreviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json +++ b/advisories/github-reviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-j4v3-wwwx-5gqv", - "modified": "2024-11-20T15:30:52Z", + "modified": "2024-11-20T18:27:56Z", "published": "2024-11-20T12:30:35Z", "aliases": [ "CVE-2024-11404" ], + "summary": "django Filer Unrestricted Upload of File with Dangerous Type", "details": "Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3.3.", "severity": [ { @@ -14,13 +15,39 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "django-filer" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.3.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11404" }, + { + "type": "WEB", + "url": "https://github.com/django-cms/django-filer/commit/f8209a6507680661bd134cd30878993b79ef3344" + }, + { + "type": "PACKAGE", + "url": "https://github.com/django-cms/django-filer" + }, { "type": "WEB", "url": "https://iltosec.com/blog/post/cve-2024-11404-medium-severity-file-upload-vulnerabilities-in-django-filer-323" @@ -44,11 +71,12 @@ ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-434" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-20T18:27:56Z", "nvd_published_at": "2024-11-20T12:15:18Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-pg82-9w35-3w3r/GHSA-pg82-9w35-3w3r.json b/advisories/github-reviewed/2024/11/GHSA-pg82-9w35-3w3r/GHSA-pg82-9w35-3w3r.json similarity index 63% rename from advisories/unreviewed/2024/11/GHSA-pg82-9w35-3w3r/GHSA-pg82-9w35-3w3r.json rename to advisories/github-reviewed/2024/11/GHSA-pg82-9w35-3w3r/GHSA-pg82-9w35-3w3r.json index 25e2d0b96e2..8f13d16a62a 100644 --- a/advisories/unreviewed/2024/11/GHSA-pg82-9w35-3w3r/GHSA-pg82-9w35-3w3r.json +++ b/advisories/github-reviewed/2024/11/GHSA-pg82-9w35-3w3r/GHSA-pg82-9w35-3w3r.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-pg82-9w35-3w3r", - "modified": "2024-11-15T06:30:33Z", + "modified": "2024-11-20T18:29:39Z", "published": "2024-11-15T06:30:33Z", "aliases": [ "CVE-2024-39610" ], + "summary": "FitNesse Cross-site scripting", "details": "Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.fitnesse:fitnesse" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "20241026" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://fitnesse.org/FitNesseDownload" }, + { + "type": "PACKAGE", + "url": "https://github.com/unclebob/fitnesse" + }, { "type": "WEB", "url": "https://github.com/unclebob/fitnesse/releases/tag/20241026" @@ -39,8 +62,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-20T18:29:39Z", "nvd_published_at": "2024-11-15T06:15:04Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json b/advisories/github-reviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json similarity index 69% rename from advisories/unreviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json rename to advisories/github-reviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json index cd90b02d1f7..a846e3d0260 100644 --- a/advisories/unreviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json +++ b/advisories/github-reviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vxcv-4xvf-pc22", - "modified": "2024-11-20T12:30:35Z", + "modified": "2024-11-20T18:29:49Z", "published": "2024-11-20T12:30:35Z", "aliases": [ "CVE-2024-11406" ], + "summary": "django CMS Attributes Field Cross-site Scripting", "details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.This issue affects django CMS Attributes Fields: before 4.0.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "djangocms-attributes-field" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.0.0" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/django-cms/djangocms-attributes-field/commit/fe68d29ab78db5885bc31b67cf0537f1f02b33ad" }, + { + "type": "PACKAGE", + "url": "https://github.com/django-cms/djangocms-attributes-field" + }, { "type": "WEB", "url": "https://iltosec.com/blog/post/djangocms-attributes-field-300-stored-xss-vulnerability" @@ -47,8 +70,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-20T18:29:49Z", "nvd_published_at": "2024-11-20T12:15:18Z" } } \ No newline at end of file