diff --git a/advisories/unreviewed/2022/04/GHSA-qp8q-gwf5-hqh2/GHSA-qp8q-gwf5-hqh2.json b/advisories/github-reviewed/2022/04/GHSA-qp8q-gwf5-hqh2/GHSA-qp8q-gwf5-hqh2.json similarity index 61% rename from advisories/unreviewed/2022/04/GHSA-qp8q-gwf5-hqh2/GHSA-qp8q-gwf5-hqh2.json rename to advisories/github-reviewed/2022/04/GHSA-qp8q-gwf5-hqh2/GHSA-qp8q-gwf5-hqh2.json index 04cd2b263d9..fc7db126c3d 100644 --- a/advisories/unreviewed/2022/04/GHSA-qp8q-gwf5-hqh2/GHSA-qp8q-gwf5-hqh2.json +++ b/advisories/github-reviewed/2022/04/GHSA-qp8q-gwf5-hqh2/GHSA-qp8q-gwf5-hqh2.json @@ -1,23 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-qp8q-gwf5-hqh2", - "modified": "2022-04-22T00:24:21Z", + "modified": "2024-04-23T22:35:50Z", "published": "2022-04-22T00:24:21Z", "aliases": [ "CVE-2011-2714" ], + "summary": "Drupal Cross-Site Scripting vulnerability", "details": "A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "versions": [ + "6.20" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2714" }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, { "type": "WEB", "url": "https://seclists.org/fulldisclosure/2011/Feb/219" @@ -33,11 +49,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:35:50Z", "nvd_published_at": "2020-01-14T22:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-2p28-5mvp-2j2r/GHSA-2p28-5mvp-2j2r.json b/advisories/github-reviewed/2022/05/GHSA-2p28-5mvp-2j2r/GHSA-2p28-5mvp-2j2r.json new file mode 100644 index 00000000000..d23f2805704 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-2p28-5mvp-2j2r/GHSA-2p28-5mvp-2j2r.json @@ -0,0 +1,126 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2p28-5mvp-2j2r", + "modified": "2024-04-23T22:36:48Z", + "published": "2022-05-14T03:35:57Z", + "aliases": [ + "CVE-2017-6926" + ], + "summary": "Drupal Comment reply form allows access to restricted content", + "details": "In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the attacker must have permission to post comments.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.4.0" + }, + { + "fixed": "8.4.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.57" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.4.0" + }, + { + "fixed": "8.4.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.57" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6926" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6926.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6926.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2018-001" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:36:48Z", + "nvd_published_at": "2018-03-01T23:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-585j-5449-mf5m/GHSA-585j-5449-mf5m.json b/advisories/github-reviewed/2022/05/GHSA-585j-5449-mf5m/GHSA-585j-5449-mf5m.json new file mode 100644 index 00000000000..c5ba5e1c146 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-585j-5449-mf5m/GHSA-585j-5449-mf5m.json @@ -0,0 +1,138 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-585j-5449-mf5m", + "modified": "2024-04-23T22:36:53Z", + "published": "2022-05-14T03:35:58Z", + "aliases": [ + "CVE-2017-6927" + ], + "summary": "Drupal cross-site scripting vulnerability", + "details": "Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.4.0" + }, + { + "fixed": "8.4.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.57" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.4.0" + }, + { + "fixed": "8.4.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.57" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6927" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6927.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6927.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html" + }, + { + "type": "WEB", + "url": "https://www.debian.org/security/2018/dsa-4123" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2018-001" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/103138" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:36:53Z", + "nvd_published_at": "2018-03-01T23:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-6g9h-6v79-w4pc/GHSA-6g9h-6v79-w4pc.json b/advisories/github-reviewed/2022/05/GHSA-6g9h-6v79-w4pc/GHSA-6g9h-6v79-w4pc.json new file mode 100644 index 00000000000..4a27c2d3956 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-6g9h-6v79-w4pc/GHSA-6g9h-6v79-w4pc.json @@ -0,0 +1,96 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6g9h-6v79-w4pc", + "modified": "2024-04-23T22:37:18Z", + "published": "2022-05-17T03:47:58Z", + "aliases": [ + "CVE-2016-7570" + ], + "summary": "Drupal Users without \"Administer comments\" can set comment visibility on nodes they can edit", + "details": "Drupal 8.x before 8.1.10 does not properly check for \"Administer comments\" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.1.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.1.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7570" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7570.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7570.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/SA-CORE-2016-004" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/93101" + }, + { + "type": "WEB", + "url": "http://www.securitytracker.com/id/1036886" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:37:18Z", + "nvd_published_at": "2016-10-03T18:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-7fh9-933g-885p/GHSA-7fh9-933g-885p.json b/advisories/github-reviewed/2022/05/GHSA-7fh9-933g-885p/GHSA-7fh9-933g-885p.json new file mode 100644 index 00000000000..a941c0dca3a --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-7fh9-933g-885p/GHSA-7fh9-933g-885p.json @@ -0,0 +1,278 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7fh9-933g-885p", + "modified": "2024-04-23T22:36:48Z", + "published": "2022-05-14T01:29:45Z", + "aliases": [ + "CVE-2018-7600" + ], + "summary": "Drupal Core Remote Code Execution Vulnerability", + "details": "Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.58" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.3.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.4.0" + }, + { + "fixed": "8.4.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.5.0" + }, + { + "fixed": "8.5.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.58" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.3.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.4" + }, + { + "fixed": "8.4.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.5" + }, + { + "fixed": "8.5.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7600" + }, + { + "type": "WEB", + "url": "https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know" + }, + { + "type": "WEB", + "url": "https://www.synology.com/support/security/Synology_SA_18_17" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/44482" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/44449" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/44448" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2018-002" + }, + { + "type": "WEB", + "url": "https://www.debian.org/security/2018/dsa-4156" + }, + { + "type": "WEB", + "url": "https://twitter.com/arancaytar/status/979090719003627521" + }, + { + "type": "WEB", + "url": "https://twitter.com/RicterZ/status/984495201354854401" + }, + { + "type": "WEB", + "url": "https://twitter.com/RicterZ/status/979567469726613504" + }, + { + "type": "WEB", + "url": "https://research.checkpoint.com/uncovering-drupalgeddon-2" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html" + }, + { + "type": "WEB", + "url": "https://groups.drupal.org/security/faq-2018-002" + }, + { + "type": "WEB", + "url": "https://greysec.net/showthread.php?tid=2912&pid=10561" + }, + { + "type": "WEB", + "url": "https://github.com/g0rx/CVE-2018-7600-Drupal-RCE" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://github.com/a2u/CVE-2018-7600" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7600.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7600.yaml" + }, + { + "type": "WEB", + "url": "https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714" + }, + { + "type": "WEB", + "url": "https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/103534" + }, + { + "type": "WEB", + "url": "http://www.securitytracker.com/id/1040598" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:36:48Z", + "nvd_published_at": "2018-03-29T07:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/04/GHSA-297x-j9pm-xjgg/GHSA-297x-j9pm-xjgg.json b/advisories/github-reviewed/2024/04/GHSA-297x-j9pm-xjgg/GHSA-297x-j9pm-xjgg.json new file mode 100644 index 00000000000..31fb4218f72 --- /dev/null +++ b/advisories/github-reviewed/2024/04/GHSA-297x-j9pm-xjgg/GHSA-297x-j9pm-xjgg.json @@ -0,0 +1,188 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-297x-j9pm-xjgg", + "modified": "2024-04-23T22:36:09Z", + "published": "2024-04-23T22:36:09Z", + "aliases": [ + "CVE-2018-7602" + ], + "summary": "Drupal Core Remote Code Execution Vulnerability", + "details": "A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.59" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.4.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.5" + }, + { + "fixed": "8.5.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.59" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.4.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.5" + }, + { + "fixed": "8.5.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7602" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7602.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7602.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html" + }, + { + "type": "WEB", + "url": "https://www.debian.org/security/2018/dsa-4180" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2018-004" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/44542" + }, + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/44557" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/103985" + }, + { + "type": "WEB", + "url": "http://www.securitytracker.com/id/1040754" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:36:09Z", + "nvd_published_at": "2018-07-19T17:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-2p28-5mvp-2j2r/GHSA-2p28-5mvp-2j2r.json b/advisories/unreviewed/2022/05/GHSA-2p28-5mvp-2j2r/GHSA-2p28-5mvp-2j2r.json deleted file mode 100644 index 3d0a1db72cc..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-2p28-5mvp-2j2r/GHSA-2p28-5mvp-2j2r.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-2p28-5mvp-2j2r", - "modified": "2022-05-14T03:35:57Z", - "published": "2022-05-14T03:35:57Z", - "aliases": [ - "CVE-2017-6926" - ], - "details": "In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the attacker must have permission to post comments.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6926" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-core-2018-001" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-03-01T23:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-585j-5449-mf5m/GHSA-585j-5449-mf5m.json b/advisories/unreviewed/2022/05/GHSA-585j-5449-mf5m/GHSA-585j-5449-mf5m.json deleted file mode 100644 index c4ce4599539..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-585j-5449-mf5m/GHSA-585j-5449-mf5m.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-585j-5449-mf5m", - "modified": "2022-05-14T03:35:58Z", - "published": "2022-05-14T03:35:58Z", - "aliases": [ - "CVE-2017-6927" - ], - "details": "Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6927" - }, - { - "type": "WEB", - "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html" - }, - { - "type": "WEB", - "url": "https://www.debian.org/security/2018/dsa-4123" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-core-2018-001" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/103138" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-03-01T23:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-6g9h-6v79-w4pc/GHSA-6g9h-6v79-w4pc.json b/advisories/unreviewed/2022/05/GHSA-6g9h-6v79-w4pc/GHSA-6g9h-6v79-w4pc.json deleted file mode 100644 index 3c93533398c..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-6g9h-6v79-w4pc/GHSA-6g9h-6v79-w4pc.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-6g9h-6v79-w4pc", - "modified": "2022-05-17T03:47:58Z", - "published": "2022-05-17T03:47:58Z", - "aliases": [ - "CVE-2016-7570" - ], - "details": "Drupal 8.x before 8.1.10 does not properly check for \"Administer comments\" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7570" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/SA-CORE-2016-004" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/93101" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1036886" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2016-10-03T18:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-7fh9-933g-885p/GHSA-7fh9-933g-885p.json b/advisories/unreviewed/2022/05/GHSA-7fh9-933g-885p/GHSA-7fh9-933g-885p.json deleted file mode 100644 index be75b5263cc..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-7fh9-933g-885p/GHSA-7fh9-933g-885p.json +++ /dev/null @@ -1,114 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-7fh9-933g-885p", - "modified": "2022-05-14T01:29:45Z", - "published": "2022-05-14T01:29:45Z", - "aliases": [ - "CVE-2018-7600" - ], - "details": "Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7600" - }, - { - "type": "WEB", - "url": "https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know" - }, - { - "type": "WEB", - "url": "https://www.synology.com/support/security/Synology_SA_18_17" - }, - { - "type": "WEB", - "url": "https://www.exploit-db.com/exploits/44482" - }, - { - "type": "WEB", - "url": "https://www.exploit-db.com/exploits/44449" - }, - { - "type": "WEB", - "url": "https://www.exploit-db.com/exploits/44448" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-core-2018-002" - }, - { - "type": "WEB", - "url": "https://www.debian.org/security/2018/dsa-4156" - }, - { - "type": "WEB", - "url": "https://twitter.com/arancaytar/status/979090719003627521" - }, - { - "type": "WEB", - "url": "https://twitter.com/RicterZ/status/984495201354854401" - }, - { - "type": "WEB", - "url": "https://twitter.com/RicterZ/status/979567469726613504" - }, - { - "type": "WEB", - "url": "https://research.checkpoint.com/uncovering-drupalgeddon-2" - }, - { - "type": "WEB", - "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html" - }, - { - "type": "WEB", - "url": "https://groups.drupal.org/security/faq-2018-002" - }, - { - "type": "WEB", - "url": "https://greysec.net/showthread.php?tid=2912&pid=10561" - }, - { - "type": "WEB", - "url": "https://github.com/g0rx/CVE-2018-7600-Drupal-RCE" - }, - { - "type": "WEB", - "url": "https://github.com/a2u/CVE-2018-7600" - }, - { - "type": "WEB", - "url": "https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714" - }, - { - "type": "WEB", - "url": "https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/103534" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1040598" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-03-29T07:29:00Z" - } -} \ No newline at end of file