From 94f692d5096b6f31a36032ab074812970b845191 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 29 Jan 2024 21:55:16 +0000
Subject: [PATCH] Publish Advisories

GHSA-pgpj-v85q-h5fm
GHSA-qjpf-2jhx-3758
GHSA-v4xv-795h-rv4h
GHSA-x22x-5pp9-8v7f
---
 .../2024/01/GHSA-pgpj-v85q-h5fm/GHSA-pgpj-v85q-h5fm.json   | 4 ++++
 .../2024/01/GHSA-qjpf-2jhx-3758/GHSA-qjpf-2jhx-3758.json   | 7 +++++--
 .../2024/01/GHSA-v4xv-795h-rv4h/GHSA-v4xv-795h-rv4h.json   | 4 ++++
 .../2024/01/GHSA-x22x-5pp9-8v7f/GHSA-x22x-5pp9-8v7f.json   | 7 +++++--
 4 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/advisories/github-reviewed/2024/01/GHSA-pgpj-v85q-h5fm/GHSA-pgpj-v85q-h5fm.json b/advisories/github-reviewed/2024/01/GHSA-pgpj-v85q-h5fm/GHSA-pgpj-v85q-h5fm.json
index 86250f0d94a..e992b2e1f7c 100644
--- a/advisories/github-reviewed/2024/01/GHSA-pgpj-v85q-h5fm/GHSA-pgpj-v85q-h5fm.json
+++ b/advisories/github-reviewed/2024/01/GHSA-pgpj-v85q-h5fm/GHSA-pgpj-v85q-h5fm.json
@@ -55,6 +55,10 @@
     {
       "type": "PACKAGE",
       "url": "https://github.com/pyload/pyload"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2024-17.yaml"
     }
   ],
   "database_specific": {
diff --git a/advisories/github-reviewed/2024/01/GHSA-qjpf-2jhx-3758/GHSA-qjpf-2jhx-3758.json b/advisories/github-reviewed/2024/01/GHSA-qjpf-2jhx-3758/GHSA-qjpf-2jhx-3758.json
index 3499af50be6..f3a63728f38 100644
--- a/advisories/github-reviewed/2024/01/GHSA-qjpf-2jhx-3758/GHSA-qjpf-2jhx-3758.json
+++ b/advisories/github-reviewed/2024/01/GHSA-qjpf-2jhx-3758/GHSA-qjpf-2jhx-3758.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-qjpf-2jhx-3758",
-  "modified": "2024-01-24T21:51:30Z",
+  "modified": "2024-01-29T21:53:55Z",
   "published": "2024-01-24T18:31:02Z",
   "aliases": [
     "CVE-2024-23904"
@@ -9,7 +9,10 @@
   "summary": "Arbitrary file read vulnerability in Jenkins Log Command Plugin",
   "details": "Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read content from arbitrary files on the Jenkins controller file system.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
   ],
   "affected": [
     {
diff --git a/advisories/github-reviewed/2024/01/GHSA-v4xv-795h-rv4h/GHSA-v4xv-795h-rv4h.json b/advisories/github-reviewed/2024/01/GHSA-v4xv-795h-rv4h/GHSA-v4xv-795h-rv4h.json
index cb20fa9ee9d..7b136805771 100644
--- a/advisories/github-reviewed/2024/01/GHSA-v4xv-795h-rv4h/GHSA-v4xv-795h-rv4h.json
+++ b/advisories/github-reviewed/2024/01/GHSA-v4xv-795h-rv4h/GHSA-v4xv-795h-rv4h.json
@@ -92,6 +92,10 @@
     {
       "type": "PACKAGE",
       "url": "https://github.com/nautobot/nautobot"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2024-16.yaml"
     }
   ],
   "database_specific": {
diff --git a/advisories/github-reviewed/2024/01/GHSA-x22x-5pp9-8v7f/GHSA-x22x-5pp9-8v7f.json b/advisories/github-reviewed/2024/01/GHSA-x22x-5pp9-8v7f/GHSA-x22x-5pp9-8v7f.json
index f2e063caafb..230f2fd92dd 100644
--- a/advisories/github-reviewed/2024/01/GHSA-x22x-5pp9-8v7f/GHSA-x22x-5pp9-8v7f.json
+++ b/advisories/github-reviewed/2024/01/GHSA-x22x-5pp9-8v7f/GHSA-x22x-5pp9-8v7f.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-x22x-5pp9-8v7f",
-  "modified": "2024-01-24T21:51:55Z",
+  "modified": "2024-01-29T21:54:26Z",
   "published": "2024-01-24T18:31:02Z",
   "aliases": [
     "CVE-2024-23905"
@@ -9,7 +9,10 @@
   "summary": "Content-Security-Policy disabled by Red Hat Dependency Analytics Jenkins Plugin",
   "details": "Jenkins sets the Content-Security-Policy header to static files served by Jenkins (specifically DirectoryBrowserSupport), such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified.\n\nRed Hat Dependency Analytics Plugin 0.7.1 and earlier globally disables the Content-Security-Policy header for static files served by Jenkins whenever the 'Invoke Red Hat Dependency Analytics (RHDA)' build step is executed. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.\n",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
     {