diff --git a/advisories/github-reviewed/2022/02/GHSA-6hr9-4692-fch9/GHSA-6hr9-4692-fch9.json b/advisories/github-reviewed/2022/02/GHSA-6hr9-4692-fch9/GHSA-6hr9-4692-fch9.json index 1f2444d16b8..049adaef3fc 100644 --- a/advisories/github-reviewed/2022/02/GHSA-6hr9-4692-fch9/GHSA-6hr9-4692-fch9.json +++ b/advisories/github-reviewed/2022/02/GHSA-6hr9-4692-fch9/GHSA-6hr9-4692-fch9.json @@ -1,13 +1,14 @@ { "schema_version": "1.4.0", "id": "GHSA-6hr9-4692-fch9", - "modified": "2021-07-28T22:11:47Z", + "modified": "2024-06-04T18:24:58Z", "published": "2022-02-10T23:45:54Z", + "withdrawn": "2024-06-04T18:24:58Z", "aliases": [ "CVE-2020-7624" ], - "summary": "OS Command Injection in effect", - "details": "effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.", + "summary": "Withdrawn Advisory: OS Command Injection in effect", + "details": "## Withdrawn Advisory\nThis advisory has been withdrawn because the [npm package effect](https://www.npmjs.com/package/effect), for which alerts were issued, does not correspond with https://github.com/Javascipt/effect, the repository with the vulnerable code. https://github.com/Javascipt/effect is not in any [supported ecosystem](https://docs.github.com/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database#github-reviewed-advisories).\n\nAdditionally, the CVE Numbering Authority that issued the CVE for CVE-2020-7624 has updated [their advisory](https://snyk.io/vuln/SNYK-JS-EFFECT-564256) stating that \"This was deemed not a vulnerability.\"\n\n## Original Description\neffect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/06/GHSA-hv2j-6654-x74q/GHSA-hv2j-6654-x74q.json b/advisories/github-reviewed/2024/06/GHSA-hv2j-6654-x74q/GHSA-hv2j-6654-x74q.json new file mode 100644 index 00000000000..669fed59ce5 --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-hv2j-6654-x74q/GHSA-hv2j-6654-x74q.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hv2j-6654-x74q", + "modified": "2024-06-04T18:23:47Z", + "published": "2024-06-03T21:30:45Z", + "aliases": [ + "CVE-2024-34051" + ], + "summary": "Reflected Cross-Site Scripting (XSS) in Dolibarr", + "details": "A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the facid parameter.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "19.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34051" + }, + { + "type": "WEB", + "url": "https://github.com/Dolibarr/dolibarr/commit/3a3ccc253b8eceddee84f158b2c262a4033b9402" + }, + { + "type": "WEB", + "url": "https://blog.smarttecs.com/posts/2024-004-cve-2024-34051" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-06-04T18:23:47Z", + "nvd_published_at": "2024-06-03T20:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-hv2j-6654-x74q/GHSA-hv2j-6654-x74q.json b/advisories/unreviewed/2024/06/GHSA-hv2j-6654-x74q/GHSA-hv2j-6654-x74q.json deleted file mode 100644 index 4caa584c741..00000000000 --- a/advisories/unreviewed/2024/06/GHSA-hv2j-6654-x74q/GHSA-hv2j-6654-x74q.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hv2j-6654-x74q", - "modified": "2024-06-03T21:30:45Z", - "published": "2024-06-03T21:30:45Z", - "aliases": [ - "CVE-2024-34051" - ], - "details": "A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the facid parameter.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34051" - }, - { - "type": "WEB", - "url": "https://blog.smarttecs.com/posts/2024-004-cve-2024-34051" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-06-03T20:15:09Z" - } -} \ No newline at end of file