From 8f8c26c128c37fabb7571b585d20f020ffb0511a Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 29 Feb 2024 20:11:24 +0000 Subject: [PATCH] Publish Advisories GHSA-3hrr-xwvg-hxvr GHSA-3rxx-8f33-7p6p GHSA-45m2-8q7f-93wv GHSA-6qvw-249j-h44c GHSA-9vx6-7xxf-x967 GHSA-9xxv-q6pp-96wq GHSA-x577-gcc9-9xjj GHSA-3rxx-8f33-7p6p GHSA-45m2-8q7f-93wv GHSA-x577-gcc9-9xjj --- .../GHSA-3hrr-xwvg-hxvr.json | 31 ++++- .../GHSA-3rxx-8f33-7p6p.json | 92 +++++++++++++ .../GHSA-45m2-8q7f-93wv.json | 69 ++++++++++ .../GHSA-6qvw-249j-h44c.json | 33 ++++- .../GHSA-9vx6-7xxf-x967.json | 127 ++++++++++++++++++ .../GHSA-9xxv-q6pp-96wq.json | 35 ++++- .../GHSA-x577-gcc9-9xjj.json | 92 +++++++++++++ .../GHSA-3rxx-8f33-7p6p.json | 39 ------ .../GHSA-45m2-8q7f-93wv.json | 39 ------ .../GHSA-x577-gcc9-9xjj.json | 39 ------ 10 files changed, 466 insertions(+), 130 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-3hrr-xwvg-hxvr/GHSA-3hrr-xwvg-hxvr.json (59%) create mode 100644 advisories/github-reviewed/2024/02/GHSA-3rxx-8f33-7p6p/GHSA-3rxx-8f33-7p6p.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-45m2-8q7f-93wv/GHSA-45m2-8q7f-93wv.json rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-6qvw-249j-h44c/GHSA-6qvw-249j-h44c.json (50%) create mode 100644 advisories/github-reviewed/2024/02/GHSA-9vx6-7xxf-x967/GHSA-9vx6-7xxf-x967.json rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-9xxv-q6pp-96wq/GHSA-9xxv-q6pp-96wq.json (58%) create mode 100644 advisories/github-reviewed/2024/02/GHSA-x577-gcc9-9xjj/GHSA-x577-gcc9-9xjj.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-3rxx-8f33-7p6p/GHSA-3rxx-8f33-7p6p.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-45m2-8q7f-93wv/GHSA-45m2-8q7f-93wv.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-x577-gcc9-9xjj/GHSA-x577-gcc9-9xjj.json diff --git a/advisories/unreviewed/2024/02/GHSA-3hrr-xwvg-hxvr/GHSA-3hrr-xwvg-hxvr.json b/advisories/github-reviewed/2024/02/GHSA-3hrr-xwvg-hxvr/GHSA-3hrr-xwvg-hxvr.json similarity index 59% rename from advisories/unreviewed/2024/02/GHSA-3hrr-xwvg-hxvr/GHSA-3hrr-xwvg-hxvr.json rename to advisories/github-reviewed/2024/02/GHSA-3hrr-xwvg-hxvr/GHSA-3hrr-xwvg-hxvr.json index 62f63fcbdfa..58831a1b3a3 100644 --- a/advisories/unreviewed/2024/02/GHSA-3hrr-xwvg-hxvr/GHSA-3hrr-xwvg-hxvr.json +++ b/advisories/github-reviewed/2024/02/GHSA-3hrr-xwvg-hxvr/GHSA-3hrr-xwvg-hxvr.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-3hrr-xwvg-hxvr", - "modified": "2024-02-29T03:33:17Z", + "modified": "2024-02-29T20:10:52Z", "published": "2024-02-29T03:33:17Z", "aliases": [ "CVE-2024-1722" ], + "summary": "Keycloak DoS via account lockout", "details": "A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "23.0.5" + } + ] + } + ] + } ], "references": [ { @@ -28,6 +47,10 @@ { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265389" + }, + { + "type": "PACKAGE", + "url": "https://github.com/keycloak/keycloak" } ], "database_specific": { @@ -35,8 +58,8 @@ "CWE-645" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T20:10:52Z", "nvd_published_at": "2024-02-29T01:43:54Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-3rxx-8f33-7p6p/GHSA-3rxx-8f33-7p6p.json b/advisories/github-reviewed/2024/02/GHSA-3rxx-8f33-7p6p/GHSA-3rxx-8f33-7p6p.json new file mode 100644 index 00000000000..09316fa113e --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-3rxx-8f33-7p6p/GHSA-3rxx-8f33-7p6p.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3rxx-8f33-7p6p", + "modified": "2024-02-29T20:10:03Z", + "published": "2024-02-29T03:33:14Z", + "aliases": [ + "CVE-2023-48653" + ], + "summary": "Concrete CMS Cross Site Request Forgery (CSRF) vulnerability", + "details": "Concrete CMS before 8.5.14 and 9 before 9.2.3 allows Cross Site Request Forgery (CSRF) via ccm/calendar/dialogs/event/delete/submit. An attacker can force an admin to delete events on the site because the event ID is numeric and sequential.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "concrete5/concrete5" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.5.14" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "concrete5/concrete5" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.2.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48653" + }, + { + "type": "WEB", + "url": "https://github.com/concretecms/concretecms/commit/077755e6bbbc1c67b7508add9e3d207e8d8909a0" + }, + { + "type": "WEB", + "url": "https://github.com/concretecms/concretecms/commit/5b93470bcccf271810d3a0b190368ce6a9d6c84b" + }, + { + "type": "WEB", + "url": "https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes" + }, + { + "type": "PACKAGE", + "url": "https://github.com/concretecms/concretecms" + }, + { + "type": "WEB", + "url": "https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T20:10:02Z", + "nvd_published_at": "2024-02-29T01:41:34Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-45m2-8q7f-93wv/GHSA-45m2-8q7f-93wv.json b/advisories/github-reviewed/2024/02/GHSA-45m2-8q7f-93wv/GHSA-45m2-8q7f-93wv.json new file mode 100644 index 00000000000..9e81c2c301f --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-45m2-8q7f-93wv/GHSA-45m2-8q7f-93wv.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-45m2-8q7f-93wv", + "modified": "2024-02-29T20:10:18Z", + "published": "2024-02-29T03:33:14Z", + "aliases": [ + "CVE-2023-48651" + ], + "summary": "Concrete CMS Cross Site Request Forgery (CSRF) vulnerability", + "details": "Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) at /ccm/system/dialogs/file/delete/1/submit.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "concrete5/concrete5" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.2.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48651" + }, + { + "type": "WEB", + "url": "https://github.com/concretecms/concretecms/commit/077755e6bbbc1c67b7508add9e3d207e8d8909a0" + }, + { + "type": "WEB", + "url": "https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes" + }, + { + "type": "PACKAGE", + "url": "https://github.com/concretecms/concretecms" + }, + { + "type": "WEB", + "url": "https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T20:10:18Z", + "nvd_published_at": "2024-02-29T01:41:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-6qvw-249j-h44c/GHSA-6qvw-249j-h44c.json b/advisories/github-reviewed/2024/02/GHSA-6qvw-249j-h44c/GHSA-6qvw-249j-h44c.json similarity index 50% rename from advisories/unreviewed/2024/02/GHSA-6qvw-249j-h44c/GHSA-6qvw-249j-h44c.json rename to advisories/github-reviewed/2024/02/GHSA-6qvw-249j-h44c/GHSA-6qvw-249j-h44c.json index a85b16a71ce..c747548f3a7 100644 --- a/advisories/unreviewed/2024/02/GHSA-6qvw-249j-h44c/GHSA-6qvw-249j-h44c.json +++ b/advisories/github-reviewed/2024/02/GHSA-6qvw-249j-h44c/GHSA-6qvw-249j-h44c.json @@ -1,23 +1,46 @@ { "schema_version": "1.4.0", "id": "GHSA-6qvw-249j-h44c", - "modified": "2024-02-29T03:33:14Z", + "modified": "2024-02-29T20:10:44Z", "published": "2024-02-29T03:33:14Z", "aliases": [ "CVE-2023-51775" ], + "summary": "jose4j denial of service via specifically crafted JWE", "details": "The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.bitbucket.b_c:jose4j" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.9.4" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51775" }, + { + "type": "WEB", + "url": "https://bitbucket.org/b_c/jose4j/commits/1afaa1e174b3" + }, { "type": "WEB", "url": "https://bitbucket.org/b_c/jose4j/issues/212" @@ -27,9 +50,9 @@ "cwe_ids": [ ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T20:10:44Z", "nvd_published_at": "2024-02-29T01:42:05Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-9vx6-7xxf-x967/GHSA-9vx6-7xxf-x967.json b/advisories/github-reviewed/2024/02/GHSA-9vx6-7xxf-x967/GHSA-9vx6-7xxf-x967.json new file mode 100644 index 00000000000..41471c2ac28 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-9vx6-7xxf-x967/GHSA-9vx6-7xxf-x967.json @@ -0,0 +1,127 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9vx6-7xxf-x967", + "modified": "2024-02-29T20:09:53Z", + "published": "2024-02-29T20:09:53Z", + "aliases": [ + "CVE-2024-27094" + ], + "summary": "OpenZeppelin Contracts base64 encoding may read from potentially dirty memory", + "details": "### Impact\n\nThe `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer.\n\nAlthough the `encode` function pads the output for these cases, up to 4 bits of data are kept between the encoding and padding, corrupting the output if these bits were dirty (i.e. memory after the input is not 0). These conditions are more frequent in the following scenarios:\n\n- A `bytes memory` struct is allocated just after the input and the first bytes of it are non-zero.\n- The memory pointer is set to a non-empty memory location before allocating the input.\n\nDevelopers should evaluate whether the extra bits can be maliciously manipulated by an attacker.\n\n### Patches\n\nUpgrade to 5.0.2 or 4.9.6.\n\n### References\n\nThis issue was reported by the Independent Security Researcher Riley Holterhus through Immunefi (@rileyholterhus on X)", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@openzeppelin/contracts" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.5.0" + }, + { + "fixed": "4.9.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@openzeppelin/contracts-upgradeable" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0-rc.0" + }, + { + "fixed": "5.0.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@openzeppelin/contracts" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0-rc.0" + }, + { + "fixed": "5.0.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@openzeppelin/contracts-upgradeable" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.5.0" + }, + { + "fixed": "4.9.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9vx6-7xxf-x967" + }, + { + "type": "WEB", + "url": "https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/2d081f24cac1a867f6f73d512f2022e1fa987854" + }, + { + "type": "WEB", + "url": "https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/723f8cab09cdae1aca9ec9cc1cfa040c2d4b06c1" + }, + { + "type": "WEB", + "url": "https://github.com/OpenZeppelin/openzeppelin-contracts/commit/92224533b1263772b0774eec3134e132a3d7b2a6" + }, + { + "type": "WEB", + "url": "https://github.com/OpenZeppelin/openzeppelin-contracts/commit/a6286d0fded8771b3a645e5813e51993c490399c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/OpenZeppelin/openzeppelin-contracts" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T20:09:53Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-9xxv-q6pp-96wq/GHSA-9xxv-q6pp-96wq.json b/advisories/github-reviewed/2024/02/GHSA-9xxv-q6pp-96wq/GHSA-9xxv-q6pp-96wq.json similarity index 58% rename from advisories/unreviewed/2024/02/GHSA-9xxv-q6pp-96wq/GHSA-9xxv-q6pp-96wq.json rename to advisories/github-reviewed/2024/02/GHSA-9xxv-q6pp-96wq/GHSA-9xxv-q6pp-96wq.json index fc38a824504..cedf6148c94 100644 --- a/advisories/unreviewed/2024/02/GHSA-9xxv-q6pp-96wq/GHSA-9xxv-q6pp-96wq.json +++ b/advisories/github-reviewed/2024/02/GHSA-9xxv-q6pp-96wq/GHSA-9xxv-q6pp-96wq.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-9xxv-q6pp-96wq", - "modified": "2024-02-29T03:33:14Z", + "modified": "2024-02-29T20:10:31Z", "published": "2024-02-29T03:33:14Z", "aliases": [ "CVE-2023-49337" ], + "summary": "Concrete CMS Stored XSS", "details": "Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. (8.5 and earlier are unaffected.)", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "concrete5/concrete5" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.2.3" + } + ] + } + ] + } ], "references": [ { @@ -29,6 +48,14 @@ "type": "WEB", "url": "https://hackerone.com/reports/2232594" }, + { + "type": "WEB", + "url": "https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes" + }, + { + "type": "PACKAGE", + "url": "https://github.com/concretecms/concretecms" + }, { "type": "WEB", "url": "https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates" @@ -39,8 +66,8 @@ ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T20:10:31Z", "nvd_published_at": "2024-02-29T01:41:37Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-x577-gcc9-9xjj/GHSA-x577-gcc9-9xjj.json b/advisories/github-reviewed/2024/02/GHSA-x577-gcc9-9xjj/GHSA-x577-gcc9-9xjj.json new file mode 100644 index 00000000000..0b6377fda00 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-x577-gcc9-9xjj/GHSA-x577-gcc9-9xjj.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x577-gcc9-9xjj", + "modified": "2024-02-29T20:09:59Z", + "published": "2024-02-29T03:33:14Z", + "aliases": [ + "CVE-2023-48650" + ], + "summary": "Concrete CMS Stored XSS in Layout Preset Name", + "details": "Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "concrete5/concrete5" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.5.14" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "concrete5/concrete5" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.2.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48650" + }, + { + "type": "WEB", + "url": "https://github.com/concretecms/concretecms/commit/077755e6bbbc1c67b7508add9e3d207e8d8909a0" + }, + { + "type": "WEB", + "url": "https://github.com/concretecms/concretecms/commit/5b93470bcccf271810d3a0b190368ce6a9d6c84b" + }, + { + "type": "WEB", + "url": "https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes" + }, + { + "type": "PACKAGE", + "url": "https://github.com/concretecms/concretecms" + }, + { + "type": "WEB", + "url": "https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T20:09:58Z", + "nvd_published_at": "2024-02-29T01:41:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-3rxx-8f33-7p6p/GHSA-3rxx-8f33-7p6p.json b/advisories/unreviewed/2024/02/GHSA-3rxx-8f33-7p6p/GHSA-3rxx-8f33-7p6p.json deleted file mode 100644 index f371cc3577b..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-3rxx-8f33-7p6p/GHSA-3rxx-8f33-7p6p.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-3rxx-8f33-7p6p", - "modified": "2024-02-29T03:33:14Z", - "published": "2024-02-29T03:33:14Z", - "aliases": [ - "CVE-2023-48653" - ], - "details": "Concrete CMS before 8.5.14 and 9 before 9.2.3 allows Cross Site Request Forgery (CSRF) via ccm/calendar/dialogs/event/delete/submit. An attacker can force an admin to delete events on the site because the event ID is numeric and sequential.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48653" - }, - { - "type": "WEB", - "url": "https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes" - }, - { - "type": "WEB", - "url": "https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-29T01:41:34Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-45m2-8q7f-93wv/GHSA-45m2-8q7f-93wv.json b/advisories/unreviewed/2024/02/GHSA-45m2-8q7f-93wv/GHSA-45m2-8q7f-93wv.json deleted file mode 100644 index cbbca8853e6..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-45m2-8q7f-93wv/GHSA-45m2-8q7f-93wv.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-45m2-8q7f-93wv", - "modified": "2024-02-29T03:33:14Z", - "published": "2024-02-29T03:33:14Z", - "aliases": [ - "CVE-2023-48651" - ], - "details": "Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) at /ccm/system/dialogs/file/delete/1/submit.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48651" - }, - { - "type": "WEB", - "url": "https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes" - }, - { - "type": "WEB", - "url": "https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-29T01:41:34Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-x577-gcc9-9xjj/GHSA-x577-gcc9-9xjj.json b/advisories/unreviewed/2024/02/GHSA-x577-gcc9-9xjj/GHSA-x577-gcc9-9xjj.json deleted file mode 100644 index 67068c643ac..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-x577-gcc9-9xjj/GHSA-x577-gcc9-9xjj.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-x577-gcc9-9xjj", - "modified": "2024-02-29T03:33:14Z", - "published": "2024-02-29T03:33:14Z", - "aliases": [ - "CVE-2023-48650" - ], - "details": "Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48650" - }, - { - "type": "WEB", - "url": "https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes" - }, - { - "type": "WEB", - "url": "https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-29T01:41:34Z" - } -} \ No newline at end of file