From 850ccf4139657ad5fd2cad4fd7d94df8ac8b361f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 20 Nov 2024 18:30:15 +0000 Subject: [PATCH] Publish Advisories GHSA-j4v3-wwwx-5gqv GHSA-pg82-9w35-3w3r GHSA-vxcv-4xvf-pc22 --- .../GHSA-j4v3-wwwx-5gqv.json | 38 ++++++++++++++++--- .../GHSA-pg82-9w35-3w3r.json | 31 +++++++++++++-- .../GHSA-vxcv-4xvf-pc22.json | 31 +++++++++++++-- 3 files changed, 87 insertions(+), 13 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json (65%) rename advisories/{unreviewed => github-reviewed}/2024/11/GHSA-pg82-9w35-3w3r/GHSA-pg82-9w35-3w3r.json (63%) rename advisories/{unreviewed => github-reviewed}/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json (69%) diff --git a/advisories/unreviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json b/advisories/github-reviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json similarity index 65% rename from advisories/unreviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json rename to advisories/github-reviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json index 7707a8de38d..9ac2a2a3274 100644 --- a/advisories/unreviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json +++ b/advisories/github-reviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-j4v3-wwwx-5gqv", - "modified": "2024-11-20T15:30:52Z", + "modified": "2024-11-20T18:27:56Z", "published": "2024-11-20T12:30:35Z", "aliases": [ "CVE-2024-11404" ], + "summary": "django Filer Unrestricted Upload of File with Dangerous Type", "details": "Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3.3.", "severity": [ { @@ -14,13 +15,39 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "django-filer" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.3.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11404" }, + { + "type": "WEB", + "url": "https://github.com/django-cms/django-filer/commit/f8209a6507680661bd134cd30878993b79ef3344" + }, + { + "type": "PACKAGE", + "url": "https://github.com/django-cms/django-filer" + }, { "type": "WEB", "url": "https://iltosec.com/blog/post/cve-2024-11404-medium-severity-file-upload-vulnerabilities-in-django-filer-323" @@ -44,11 +71,12 @@ ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-434" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-20T18:27:56Z", "nvd_published_at": "2024-11-20T12:15:18Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-pg82-9w35-3w3r/GHSA-pg82-9w35-3w3r.json b/advisories/github-reviewed/2024/11/GHSA-pg82-9w35-3w3r/GHSA-pg82-9w35-3w3r.json similarity index 63% rename from advisories/unreviewed/2024/11/GHSA-pg82-9w35-3w3r/GHSA-pg82-9w35-3w3r.json rename to advisories/github-reviewed/2024/11/GHSA-pg82-9w35-3w3r/GHSA-pg82-9w35-3w3r.json index 25e2d0b96e2..8f13d16a62a 100644 --- a/advisories/unreviewed/2024/11/GHSA-pg82-9w35-3w3r/GHSA-pg82-9w35-3w3r.json +++ b/advisories/github-reviewed/2024/11/GHSA-pg82-9w35-3w3r/GHSA-pg82-9w35-3w3r.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-pg82-9w35-3w3r", - "modified": "2024-11-15T06:30:33Z", + "modified": "2024-11-20T18:29:39Z", "published": "2024-11-15T06:30:33Z", "aliases": [ "CVE-2024-39610" ], + "summary": "FitNesse Cross-site scripting", "details": "Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.fitnesse:fitnesse" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "20241026" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://fitnesse.org/FitNesseDownload" }, + { + "type": "PACKAGE", + "url": "https://github.com/unclebob/fitnesse" + }, { "type": "WEB", "url": "https://github.com/unclebob/fitnesse/releases/tag/20241026" @@ -39,8 +62,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-20T18:29:39Z", "nvd_published_at": "2024-11-15T06:15:04Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json b/advisories/github-reviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json similarity index 69% rename from advisories/unreviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json rename to advisories/github-reviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json index cd90b02d1f7..a846e3d0260 100644 --- a/advisories/unreviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json +++ b/advisories/github-reviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vxcv-4xvf-pc22", - "modified": "2024-11-20T12:30:35Z", + "modified": "2024-11-20T18:29:49Z", "published": "2024-11-20T12:30:35Z", "aliases": [ "CVE-2024-11406" ], + "summary": "django CMS Attributes Field Cross-site Scripting", "details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.This issue affects django CMS Attributes Fields: before 4.0.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "djangocms-attributes-field" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.0.0" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/django-cms/djangocms-attributes-field/commit/fe68d29ab78db5885bc31b67cf0537f1f02b33ad" }, + { + "type": "PACKAGE", + "url": "https://github.com/django-cms/djangocms-attributes-field" + }, { "type": "WEB", "url": "https://iltosec.com/blog/post/djangocms-attributes-field-300-stored-xss-vulnerability" @@ -47,8 +70,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-20T18:29:49Z", "nvd_published_at": "2024-11-20T12:15:18Z" } } \ No newline at end of file