Publish Advisories

GHSA-6hh7-46r2-vf29
GHSA-cg24-jjr5-rxmf
GHSA-pmf3-c36m-g5cf

advisories/github-reviewed/2024/03/GHSA-6hh7-46r2-vf29/GHSA-6hh7-46r2-vf29.json

@@ -0,0 +1,88 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6hh7-46r2-vf29",
+  "modified": "2024-03-19T20:07:35Z",
+  "published": "2024-03-19T20:07:35Z",
+  "aliases": [
+    "CVE-2024-29027"
+  ],
+  "summary": "Server crashes on invalid Cloud Function or Cloud Job name",
+  "details": "### Impact\n\nCalling an invalid Parse Server Cloud Function name or Cloud Job name crashes server and may allow for code injection.\n\n### Patches\n\nAdded string sanitation for Cloud Function name and Cloud Job name.\n\n### Workarounds\n\nSanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.\n\n### References\n\n- https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29\n- https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 (Fix for Parse Server 7 alpha)\n- https://github.com/parse-community/parse-server/releases/tag/6.5.5 (Fix for Parse Server 6 LTS)",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "parse-server"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "6.5.5"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "parse-server"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.0.0-alpha.1"
+            },
+            {
+              "fixed": "7.0.0-alpha.29"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/parse-community/parse-server"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/parse-community/parse-server/releases/tag/6.5.5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-03-19T20:07:35Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2024/03/GHSA-cg24-jjr5-rxmf/GHSA-cg24-jjr5-rxmf.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-cg24-jjr5-rxmf",
-  "modified": "2024-03-19T09:30:32Z",
+  "modified": "2024-03-19T20:07:18Z",
   "published": "2024-03-19T09:30:32Z",
   "aliases": [
     "CVE-2024-24042"
   ],
+  "summary": "Path traversal in flaskcode Devan-Kerman ARRP",
   "details": "Directory Traversal vulnerability in Devan-Kerman ARRP v.0.8.1 and before allows a remote attacker to execute arbitrary code via the dumpDirect in RuntimeResourcePackImpl component.",
   "severity": [
     {
@@ -14,7 +15,28 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "net.devtech:arrp"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.8.2"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 0.8.1"
+      }
+    }
   ],
   "references": [
     {
@@ -28,15 +50,19 @@
     {
       "type": "WEB",
       "url": "https://gist.github.com/apple502j/193358682885fe1a6708309ce934e4ed"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Devan-Kerman/ARRP"
     }
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-22"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-03-19T20:07:18Z",
     "nvd_published_at": "2024-03-19T07:15:09Z"
   }
 }