diff --git a/advisories/unreviewed/2024/03/GHSA-pmm3-68q9-57jg/GHSA-pmm3-68q9-57jg.json b/advisories/github-reviewed/2024/03/GHSA-pmm3-68q9-57jg/GHSA-pmm3-68q9-57jg.json similarity index 58% rename from advisories/unreviewed/2024/03/GHSA-pmm3-68q9-57jg/GHSA-pmm3-68q9-57jg.json rename to advisories/github-reviewed/2024/03/GHSA-pmm3-68q9-57jg/GHSA-pmm3-68q9-57jg.json index 72665597c25..02d394e54a6 100644 --- a/advisories/unreviewed/2024/03/GHSA-pmm3-68q9-57jg/GHSA-pmm3-68q9-57jg.json +++ b/advisories/github-reviewed/2024/03/GHSA-pmm3-68q9-57jg/GHSA-pmm3-68q9-57jg.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-pmm3-68q9-57jg", - "modified": "2024-08-01T21:31:39Z", + "modified": "2024-08-02T13:27:23Z", "published": "2024-03-22T06:30:24Z", "aliases": [ "CVE-2024-29272" ], + "summary": "VvvebJs Arbitrary File Upload vulnerability", "details": "Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "vvvebJs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.7.5" + } + ] + } + ] + } ], "references": [ { @@ -28,6 +51,10 @@ { "type": "WEB", "url": "https://github.com/givanz/VvvebJs/commit/c6422cfd4d835c2fa6d512645e30015f24538ef0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/givanz/VvvebJs" } ], "database_specific": { @@ -35,8 +62,8 @@ "CWE-434" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-08-02T13:27:23Z", "nvd_published_at": "2024-03-22T04:15:11Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-3cpf-jmmc-8jm3/GHSA-3cpf-jmmc-8jm3.json b/advisories/github-reviewed/2024/08/GHSA-3cpf-jmmc-8jm3/GHSA-3cpf-jmmc-8jm3.json new file mode 100644 index 00000000000..9b4aa93c56a --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-3cpf-jmmc-8jm3/GHSA-3cpf-jmmc-8jm3.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3cpf-jmmc-8jm3", + "modified": "2024-08-02T13:27:51Z", + "published": "2024-08-01T21:31:40Z", + "aliases": [ + "CVE-2024-4353" + ], + "summary": "Concrete CMS vulnerable to Stored Cross-site Scripting", + "details": "Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input field does not check the input sufficiently letting a rogue administrator hav the capability to inject malicious JavaScript code.\n\nThe Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator and a CVSS v4 score of 1.8 with a vector of CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Thanks fhAnso for reporting.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "concrete5/concrete5" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "last_affected": "9.3.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4353" + }, + { + "type": "WEB", + "url": "https://github.com/concretecms/concretecms/pull/12151" + }, + { + "type": "WEB", + "url": "https://github.com/concretecms/concretecms/commit/ff5a2aba7fbc1ff0368202a2c0afddea47136daf" + }, + { + "type": "PACKAGE", + "url": "https://github.com/concretecms/concretecms" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-08-02T13:27:51Z", + "nvd_published_at": "2024-08-01T19:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-3cpf-jmmc-8jm3/GHSA-3cpf-jmmc-8jm3.json b/advisories/unreviewed/2024/08/GHSA-3cpf-jmmc-8jm3/GHSA-3cpf-jmmc-8jm3.json deleted file mode 100644 index bc2786e4bef..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-3cpf-jmmc-8jm3/GHSA-3cpf-jmmc-8jm3.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-3cpf-jmmc-8jm3", - "modified": "2024-08-01T21:31:40Z", - "published": "2024-08-01T21:31:40Z", - "aliases": [ - "CVE-2024-4353" - ], - "details": "Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board\ninstance functionality. The Name input field does not check the input sufficiently letting a rogue administrator hav the capability to inject malicious\nJavaScript code. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator  and a CVSS v4 score of 1.8 with a vector of CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Thanks fhAnso for reporting.", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4353" - }, - { - "type": "WEB", - "url": "https://github.com/concretecms/concretecms/pull/12151" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-01T19:15:52Z" - } -} \ No newline at end of file