diff --git a/advisories/unreviewed/2022/05/GHSA-864w-r5qj-h6fj/GHSA-864w-r5qj-h6fj.json b/advisories/github-reviewed/2022/05/GHSA-864w-r5qj-h6fj/GHSA-864w-r5qj-h6fj.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-864w-r5qj-h6fj/GHSA-864w-r5qj-h6fj.json rename to advisories/github-reviewed/2022/05/GHSA-864w-r5qj-h6fj/GHSA-864w-r5qj-h6fj.json index 898e516da7c..4bdcd65f5bb 100644 --- a/advisories/unreviewed/2022/05/GHSA-864w-r5qj-h6fj/GHSA-864w-r5qj-h6fj.json +++ b/advisories/github-reviewed/2022/05/GHSA-864w-r5qj-h6fj/GHSA-864w-r5qj-h6fj.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-864w-r5qj-h6fj", - "modified": "2025-04-20T03:46:51Z", + "modified": "2025-04-23T02:23:16Z", "published": "2022-05-14T01:05:57Z", "aliases": [ "CVE-2016-4461" ], + "summary": "Apache Struts forced double OGNL evaluation", "details": "Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a \"%{}\" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.", "severity": [ { @@ -13,12 +14,36 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.struts:struts2-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.3.29" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4461" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/struts" + }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20180629-0004" @@ -26,19 +51,16 @@ { "type": "WEB", "url": "https://struts.apache.org/docs/s2-036.html" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/91277" } ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-74" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-23T02:23:16Z", "nvd_published_at": "2017-10-16T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-gvgf-fp4m-2hw6/GHSA-gvgf-fp4m-2hw6.json b/advisories/github-reviewed/2022/05/GHSA-gvgf-fp4m-2hw6/GHSA-gvgf-fp4m-2hw6.json similarity index 65% rename from advisories/unreviewed/2022/05/GHSA-gvgf-fp4m-2hw6/GHSA-gvgf-fp4m-2hw6.json rename to advisories/github-reviewed/2022/05/GHSA-gvgf-fp4m-2hw6/GHSA-gvgf-fp4m-2hw6.json index 8457c89de03..eaf01029c65 100644 --- a/advisories/unreviewed/2022/05/GHSA-gvgf-fp4m-2hw6/GHSA-gvgf-fp4m-2hw6.json +++ b/advisories/github-reviewed/2022/05/GHSA-gvgf-fp4m-2hw6/GHSA-gvgf-fp4m-2hw6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-gvgf-fp4m-2hw6", - "modified": "2025-04-20T03:46:39Z", + "modified": "2025-04-23T02:22:39Z", "published": "2022-05-13T01:24:45Z", "aliases": [ "CVE-2017-15284" ], + "summary": "OctoberCMS Cross-Site Scripting", "details": "Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "october/rain" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.426" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -23,6 +44,10 @@ "type": "WEB", "url": "https://github.com/octobercms/library/commit/3bbbbf3da469f457881b5af902eb0b89b95189a2" }, + { + "type": "PACKAGE", + "url": "https://github.com/octobercms/october" + }, { "type": "WEB", "url": "https://packetstormsecurity.com/files/144587/OctoberCMS-1.0.425-Cross-Site-Scripting.html" @@ -37,8 +62,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-23T02:22:39Z", "nvd_published_at": "2017-10-12T08:29:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-hqwh-8xv9-42hw/GHSA-hqwh-8xv9-42hw.json b/advisories/github-reviewed/2022/05/GHSA-hqwh-8xv9-42hw/GHSA-hqwh-8xv9-42hw.json new file mode 100644 index 00000000000..42da8fa980f --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-hqwh-8xv9-42hw/GHSA-hqwh-8xv9-42hw.json @@ -0,0 +1,74 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hqwh-8xv9-42hw", + "modified": "2025-04-23T02:23:37Z", + "published": "2022-05-17T00:22:00Z", + "aliases": [ + "CVE-2017-14992" + ], + "summary": "tar-split memory exhaustion", + "details": "Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/vbatts/tar-split" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.10.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14992" + }, + { + "type": "WEB", + "url": "https://github.com/moby/moby/issues/35075" + }, + { + "type": "WEB", + "url": "https://github.com/vbatts/tar-split/pull/42" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vbatts/tar-split" + }, + { + "type": "WEB", + "url": "https://github.com/vbatts/tar-split/releases/tag/v0.10.2" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20171119174639/https://blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20", + "CWE-770" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-23T02:23:36Z", + "nvd_published_at": "2017-11-01T17:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-q4hw-62mx-q37w/GHSA-q4hw-62mx-q37w.json b/advisories/github-reviewed/2022/05/GHSA-q4hw-62mx-q37w/GHSA-q4hw-62mx-q37w.json similarity index 60% rename from advisories/unreviewed/2022/05/GHSA-q4hw-62mx-q37w/GHSA-q4hw-62mx-q37w.json rename to advisories/github-reviewed/2022/05/GHSA-q4hw-62mx-q37w/GHSA-q4hw-62mx-q37w.json index 38df845845f..0b94cb0eda6 100644 --- a/advisories/unreviewed/2022/05/GHSA-q4hw-62mx-q37w/GHSA-q4hw-62mx-q37w.json +++ b/advisories/github-reviewed/2022/05/GHSA-q4hw-62mx-q37w/GHSA-q4hw-62mx-q37w.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-q4hw-62mx-q37w", - "modified": "2025-04-20T03:48:10Z", + "modified": "2025-04-23T02:24:09Z", "published": "2022-05-17T00:20:54Z", "aliases": [ "CVE-2015-3933" ], + "summary": "MetalGenix GeniXCMS vulnerable to SQL Injection", "details": "Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) email parameter or (2) userid parameter to register.php.", "severity": [ { @@ -13,12 +14,36 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "genix/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.0.3" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3933" }, + { + "type": "PACKAGE", + "url": "https://github.com/GeniXCMS/GeniXCMS" + }, { "type": "WEB", "url": "https://github.com/semplon/GeniXCMS/releases/tag/v0.0.3-patch" @@ -33,8 +58,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-23T02:24:09Z", "nvd_published_at": "2017-11-08T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-rvmg-xc29-rvxf/GHSA-rvmg-xc29-rvxf.json b/advisories/github-reviewed/2022/05/GHSA-rvmg-xc29-rvxf/GHSA-rvmg-xc29-rvxf.json new file mode 100644 index 00000000000..31ca3130c4f --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-rvmg-xc29-rvxf/GHSA-rvmg-xc29-rvxf.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rvmg-xc29-rvxf", + "modified": "2025-04-23T02:22:52Z", + "published": "2022-05-13T01:10:42Z", + "aliases": [ + "CVE-2017-15363" + ], + "summary": "Luracast Restler directory traversal vulnerability", + "details": "Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 for TYPO3, allows remote attackers to read arbitrary files via the file parameter.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "aoe/restler" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.7.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "luracast/restler" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15363" + }, + { + "type": "WEB", + "url": "https://extensions.typo3.org/extension/restler" + }, + { + "type": "PACKAGE", + "url": "https://github.com/AOEpeople/TYPO3_Restler" + }, + { + "type": "WEB", + "url": "https://github.com/AOEpeople/TYPO3_Restler/releases/tag/1.7.1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-23T02:22:51Z", + "nvd_published_at": "2017-10-15T19:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-hqwh-8xv9-42hw/GHSA-hqwh-8xv9-42hw.json b/advisories/unreviewed/2022/05/GHSA-hqwh-8xv9-42hw/GHSA-hqwh-8xv9-42hw.json deleted file mode 100644 index c84813ba3da..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-hqwh-8xv9-42hw/GHSA-hqwh-8xv9-42hw.json +++ /dev/null @@ -1,40 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hqwh-8xv9-42hw", - "modified": "2025-04-20T03:47:56Z", - "published": "2022-05-17T00:22:00Z", - "aliases": [ - "CVE-2017-14992" - ], - "details": "Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14992" - }, - { - "type": "WEB", - "url": "https://github.com/moby/moby/issues/35075" - }, - { - "type": "WEB", - "url": "https://blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-11-01T17:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-rvmg-xc29-rvxf/GHSA-rvmg-xc29-rvxf.json b/advisories/unreviewed/2022/05/GHSA-rvmg-xc29-rvxf/GHSA-rvmg-xc29-rvxf.json deleted file mode 100644 index 6952689b760..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-rvmg-xc29-rvxf/GHSA-rvmg-xc29-rvxf.json +++ /dev/null @@ -1,40 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-rvmg-xc29-rvxf", - "modified": "2025-04-20T03:46:50Z", - "published": "2022-05-13T01:10:42Z", - "aliases": [ - "CVE-2017-15363" - ], - "details": "Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 for TYPO3, allows remote attackers to read arbitrary files via the file parameter.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15363" - }, - { - "type": "WEB", - "url": "https://extensions.typo3.org/extension/download/restler/1.7.1/zip" - }, - { - "type": "WEB", - "url": "https://extensions.typo3.org/extension/restler" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-22" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-10-15T19:29:00Z" - } -} \ No newline at end of file