diff --git a/advisories/unreviewed/2025/04/GHSA-3gc7-fjrx-p6mg/GHSA-3gc7-fjrx-p6mg.json b/advisories/github-reviewed/2025/04/GHSA-3gc7-fjrx-p6mg/GHSA-3gc7-fjrx-p6mg.json similarity index 55% rename from advisories/unreviewed/2025/04/GHSA-3gc7-fjrx-p6mg/GHSA-3gc7-fjrx-p6mg.json rename to advisories/github-reviewed/2025/04/GHSA-3gc7-fjrx-p6mg/GHSA-3gc7-fjrx-p6mg.json index 558b31f48ea..d02b28e1743 100644 --- a/advisories/unreviewed/2025/04/GHSA-3gc7-fjrx-p6mg/GHSA-3gc7-fjrx-p6mg.json +++ b/advisories/github-reviewed/2025/04/GHSA-3gc7-fjrx-p6mg/GHSA-3gc7-fjrx-p6mg.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-3gc7-fjrx-p6mg", - "modified": "2025-04-04T06:34:23Z", + "modified": "2025-04-04T18:23:45Z", "published": "2025-04-04T06:34:22Z", "aliases": [ "CVE-2025-3194" ], - "details": "Versions of the package bigint-buffer from 0.0.0 are vulnerable to Buffer Overflow in the toBigIntLE() function. Attackers can exploit this to crash the application.", + "summary": "bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function", + "details": "Versions of the package bigint-buffer from 0.0.0 to 1.1.5 are vulnerable to Buffer Overflow in the toBigIntLE() function. Attackers can exploit this to crash the application.", "severity": [ { "type": "CVSS_V3", @@ -17,15 +18,39 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "bigint-buffer" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.1.5" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3194" }, + { + "type": "PACKAGE", + "url": "https://github.com/no2chem/bigint-buffer" + }, { "type": "WEB", - "url": "https://github.com/no2chem/bigint-buffer/blob/master/src/index.ts%23L25" + "url": "https://github.com/no2chem/bigint-buffer/blob/master/src/index.ts#L25" }, { "type": "WEB", @@ -41,8 +66,8 @@ "CWE-120" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-04T18:23:45Z", "nvd_published_at": "2025-04-04T05:15:45Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-4vjr-hfpp-2m7w/GHSA-4vjr-hfpp-2m7w.json b/advisories/github-reviewed/2025/04/GHSA-4vjr-hfpp-2m7w/GHSA-4vjr-hfpp-2m7w.json similarity index 51% rename from advisories/unreviewed/2025/04/GHSA-4vjr-hfpp-2m7w/GHSA-4vjr-hfpp-2m7w.json rename to advisories/github-reviewed/2025/04/GHSA-4vjr-hfpp-2m7w/GHSA-4vjr-hfpp-2m7w.json index e9c4b320631..259fbdbda75 100644 --- a/advisories/unreviewed/2025/04/GHSA-4vjr-hfpp-2m7w/GHSA-4vjr-hfpp-2m7w.json +++ b/advisories/github-reviewed/2025/04/GHSA-4vjr-hfpp-2m7w/GHSA-4vjr-hfpp-2m7w.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-4vjr-hfpp-2m7w", - "modified": "2025-04-04T06:34:23Z", + "modified": "2025-04-04T18:24:05Z", "published": "2025-04-04T06:34:23Z", "aliases": [ "CVE-2025-3197" ], - "details": "Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like __proto__.", + "summary": "expand-object Vulnerable to Prototype Pollution via the expand() Function", + "details": "Versions of the package expand-object from 0.0.0 to 0.4.2 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like __proto__.", "severity": [ { "type": "CVSS_V3", @@ -17,7 +18,27 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "expand-object" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.4.2" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -27,9 +48,13 @@ "type": "WEB", "url": "https://gist.github.com/miguelafmonteiro/d8f66af61d14e06338b688f90c4dfa7c" }, + { + "type": "PACKAGE", + "url": "https://github.com/jonschlinkert/expand-object" + }, { "type": "WEB", - "url": "https://github.com/jonschlinkert/expand-object/blob/master/index.js%23L13" + "url": "https://github.com/jonschlinkert/expand-object/blob/master/index.js#L13" }, { "type": "WEB", @@ -41,8 +66,8 @@ "CWE-1321" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-04T18:24:05Z", "nvd_published_at": "2025-04-04T05:15:46Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-fq5x-7292-2p5r/GHSA-fq5x-7292-2p5r.json b/advisories/github-reviewed/2025/04/GHSA-fq5x-7292-2p5r/GHSA-fq5x-7292-2p5r.json similarity index 62% rename from advisories/unreviewed/2025/04/GHSA-fq5x-7292-2p5r/GHSA-fq5x-7292-2p5r.json rename to advisories/github-reviewed/2025/04/GHSA-fq5x-7292-2p5r/GHSA-fq5x-7292-2p5r.json index 2b1a5ae2b32..8ae2bea4236 100644 --- a/advisories/unreviewed/2025/04/GHSA-fq5x-7292-2p5r/GHSA-fq5x-7292-2p5r.json +++ b/advisories/github-reviewed/2025/04/GHSA-fq5x-7292-2p5r/GHSA-fq5x-7292-2p5r.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fq5x-7292-2p5r", - "modified": "2025-04-04T06:34:22Z", + "modified": "2025-04-04T18:23:07Z", "published": "2025-04-04T06:34:22Z", "aliases": [ "CVE-2025-3191" ], + "summary": "React Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button", "details": "All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the