From 8ff08da8209b2950fc939aa5911d8e98435a4bb4 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 21 Aug 2024 18:51:45 +0000
Subject: [PATCH] Publish Advisories

GHSA-86jx-wr74-xr74
GHSA-6pjm-hmvf-h4rr
---
 .../GHSA-86jx-wr74-xr74/GHSA-86jx-wr74-xr74.json  | 15 +++++++++++----
 .../GHSA-6pjm-hmvf-h4rr/GHSA-6pjm-hmvf-h4rr.json  | 15 +++++++++++----
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/advisories/github-reviewed/2024/04/GHSA-86jx-wr74-xr74/GHSA-86jx-wr74-xr74.json b/advisories/github-reviewed/2024/04/GHSA-86jx-wr74-xr74/GHSA-86jx-wr74-xr74.json
index d745f196d92..947a4074a05 100644
--- a/advisories/github-reviewed/2024/04/GHSA-86jx-wr74-xr74/GHSA-86jx-wr74-xr74.json
+++ b/advisories/github-reviewed/2024/04/GHSA-86jx-wr74-xr74/GHSA-86jx-wr74-xr74.json
@@ -1,15 +1,22 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-86jx-wr74-xr74",
-  "modified": "2024-05-24T20:11:32Z",
+  "modified": "2024-08-21T18:50:22Z",
   "published": "2024-04-09T18:30:22Z",
   "aliases": [
     "CVE-2024-31866"
   ],
   "summary": "Improper escaping in Apache Zeppelin",
-  "details": "Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.\n\nThe attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES.\nThis issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.\n\nUsers are recommended to upgrade to version 0.11.1, which fixes the issue.\n\n",
+  "details": "Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.\n\nThe attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES.\nThis issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.\n\nUsers are recommended to upgrade to version 0.11.1, which fixes the issue.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -62,7 +69,7 @@
     "cwe_ids": [
       "CWE-116"
     ],
-    "severity": "MODERATE",
+    "severity": "CRITICAL",
     "github_reviewed": true,
     "github_reviewed_at": "2024-05-24T20:11:32Z",
     "nvd_published_at": "2024-04-09T16:15:08Z"
diff --git a/advisories/github-reviewed/2024/05/GHSA-6pjm-hmvf-h4rr/GHSA-6pjm-hmvf-h4rr.json b/advisories/github-reviewed/2024/05/GHSA-6pjm-hmvf-h4rr/GHSA-6pjm-hmvf-h4rr.json
index 7ea24e2d455..411dbc8270a 100644
--- a/advisories/github-reviewed/2024/05/GHSA-6pjm-hmvf-h4rr/GHSA-6pjm-hmvf-h4rr.json
+++ b/advisories/github-reviewed/2024/05/GHSA-6pjm-hmvf-h4rr/GHSA-6pjm-hmvf-h4rr.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6pjm-hmvf-h4rr",
-  "modified": "2024-05-06T14:35:28Z",
+  "modified": "2024-08-21T18:50:42Z",
   "published": "2024-05-05T21:30:31Z",
   "aliases": [
     "CVE-2024-34515"
@@ -9,7 +9,14 @@
   "summary": "image-optimizer allows PHAR deserialization",
   "details": "image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the `phar://` protocol in arguments to `file_exists()`.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -60,9 +67,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-502"
     ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2024-05-06T14:35:28Z",
     "nvd_published_at": "2024-05-05T21:15:55Z"