diff --git a/advisories/github-reviewed/2021/03/GHSA-cvw2-xj8r-mjf7/GHSA-cvw2-xj8r-mjf7.json b/advisories/github-reviewed/2021/03/GHSA-cvw2-xj8r-mjf7/GHSA-cvw2-xj8r-mjf7.json index b6124ed65ac..c36142d586e 100644 --- a/advisories/github-reviewed/2021/03/GHSA-cvw2-xj8r-mjf7/GHSA-cvw2-xj8r-mjf7.json +++ b/advisories/github-reviewed/2021/03/GHSA-cvw2-xj8r-mjf7/GHSA-cvw2-xj8r-mjf7.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-cvw2-xj8r-mjf7", - "modified": "2023-01-24T15:02:38Z", + "modified": "2023-09-05T22:00:39Z", "published": "2021-03-09T00:45:31Z", "aliases": [ "CVE-2019-25025" ], - "summary": "Activerecord-session_store Timing Attack", + "summary": "Activerecord-session_store Vulnerable to Timing Attack", "details": "The `activerecord-session_store` (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782. \n\n## Recommendation\n\nThis has been fixed in version 2.0.0. All users are advised to update to this version or later.", "severity": [ { @@ -20,6 +20,11 @@ "ecosystem": "RubyGems", "name": "activerecord-session_store" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", diff --git a/advisories/github-reviewed/2021/08/GHSA-f2c9-5jqw-3xh3/GHSA-f2c9-5jqw-3xh3.json b/advisories/github-reviewed/2021/08/GHSA-f2c9-5jqw-3xh3/GHSA-f2c9-5jqw-3xh3.json index 3ade78f5edd..c09d454b0e1 100644 --- a/advisories/github-reviewed/2021/08/GHSA-f2c9-5jqw-3xh3/GHSA-f2c9-5jqw-3xh3.json +++ b/advisories/github-reviewed/2021/08/GHSA-f2c9-5jqw-3xh3/GHSA-f2c9-5jqw-3xh3.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-f2c9-5jqw-3xh3", - "modified": "2023-01-24T15:03:13Z", + "modified": "2023-09-05T21:59:59Z", "published": "2021-08-02T17:23:39Z", "aliases": [ "CVE-2021-28796" ], - "summary": "Cross-Site Scripting in Qiita::Markdown", - "details": "Increments Qiita::Markdown before 0.33.0 allows XSS in transformers.", + "summary": "Cross-Site Scripting in Qiita-Markdown", + "details": "Increments Qiita-Markdown before 0.33.0 allows XSS in transformers.", "severity": [ { "type": "CVSS_V3", @@ -20,6 +20,11 @@ "ecosystem": "RubyGems", "name": "qiita-markdown" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM",