Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2022-07-27 00:15:27 +00:00
parent a6661ad075
commit 9f1de46e9b
244 changed files with 4973 additions and 500 deletions
@@ -25,6 +25,10 @@
      "type": "WEB",
      "url": "https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/"
+    },
    {
      "type": "WEB",
      "url": "https://lua-users.org/lists/lua-l/2022-02/msg00001.html"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-3m7c-wp57-w3xx",
-  "modified": "2022-05-24T17:47:44Z",
+  "modified": "2022-07-27T00:00:48Z",
  "published": "2022-05-24T17:47:44Z",
  "aliases": [
    "CVE-2020-9668"
  ],
  "details": "Adobe Genuine Service version 6.6 (and earlier) is affected by an Improper Access control vulnerability when handling symbolic links. An unauthenticated attacker could exploit this to elevate privileges in the context of the current user.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-hx54-cc43-34cx",
-  "modified": "2022-05-24T19:08:06Z",
+  "modified": "2022-07-27T00:00:46Z",
  "published": "2022-05-24T19:08:06Z",
  "aliases": [
    "CVE-2021-0291"
  ],
  "details": "An Exposure of System Data vulnerability in Juniper Networks Junos OS and Junos OS Evolved, where a sensitive system-level resource is not being sufficiently protected, allows a network-based unauthenticated attacker to send specific traffic which partially reaches this resource. A high rate of specific traffic may lead to a partial Denial of Service (DoS) as the CPU utilization of the RE is significantly increased. The SNMP Agent Extensibility (agentx) process should only be listening to TCP port 705 on the internal routing instance. External connections destined to port 705 should not be allowed. This issue affects: Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S12; 17.4 versions prior to 17.4R2-S13, 17.4R3-S5; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S8; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R2; 20.3 versions prior to 20.3R2. Juniper Networks Junos OS Evolved versions prior to 20.3R2-EVO. This issue does not affect Juniper Networks Junos OS versions prior to 13.2R1.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
+    }
  ],
  "affected": [

@@ -0,0 +1,37 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-23v4-qfpm-c2cx",
+  "modified": "2022-07-27T00:00:30Z",
+  "published": "2022-07-27T00:00:30Z",
+  "aliases": [
+    "CVE-2022-30272"
+  ],
+  "details": "The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. It utilizes either the STS software suite or ACE1000 Easy Configurator for performing firmware updates. In case of the Easy Configurator, firmware updates are performed through access to the Web UI where file system, kernel, package, bundle, or application images can be installed. Firmware updates for the Front End Processor (FEP) module are performed via access to the SSH interface (22/TCP), where a .hex file image is transferred and a bootloader script invoked. File system, kernel, package, and bundle updates are supplied as RPM (RPM Package Manager) files while FEP updates are supplied as S-rec files. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30272"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.forescout.com/blog/"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-269h-pcpx-q5mj",
-  "modified": "2022-07-22T00:00:30Z",
+  "modified": "2022-07-27T00:00:45Z",
  "published": "2022-07-22T00:00:30Z",
  "aliases": [
    "CVE-2022-0977"
  ],
  "details": "Use after free in Browser UI in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-416"
    ],
-    "severity": null,
+    "severity": "CRITICAL",
    "github_reviewed": false
  }
 }
@@ -0,0 +1,37 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-276r-jxx7-v78h",
+  "modified": "2022-07-27T00:00:32Z",
+  "published": "2022-07-27T00:00:32Z",
+  "aliases": [
+    "CVE-2022-1634"
+  ],
+  "details": "Use after free in Browser UI in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who had convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific user interactions.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1634"
+    },
+    {
+      "type": "WEB",
+      "url": "https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://crbug.com/1314908"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-287j-mmhv-xfrf",
-  "modified": "2022-07-22T00:00:39Z",
+  "modified": "2022-07-27T00:00:44Z",
  "published": "2022-07-22T00:00:39Z",
  "aliases": [
    "CVE-2022-20876"
  ],
  "details": "Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition. These vulnerabilities are due to insufficient validation of user fields within incoming HTTP packets. An attacker could exploit these vulnerabilities by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on an affected device with root-level privileges or to cause the device to restart unexpectedly, resulting in a DoS condition. To exploit these vulnerabilities, an attacker would need to have valid Administrator credentials on the affected device. Cisco has not released software updates that address these vulnerabilities.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-78"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false
  }
 }
@@ -0,0 +1,37 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-28mf-w32g-rfg3",
+  "modified": "2022-07-27T00:00:31Z",
+  "published": "2022-07-27T00:00:31Z",
+  "aliases": [
+    "CVE-2021-33057"
+  ],
+  "details": "The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the device's physical location. An attacker can use qq.createMapContext to create a MapContext object, use MapContext.moveToLocation to move the center of the map to the device's location, and use MapContext.getCenterLocation to get the latitude and longitude of the current map center.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33057"
+    },
+    {
+      "type": "WEB",
+      "url": "https://arxiv.org/pdf/2205.15202.pdf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://tencent.com"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-295j-q39j-ww99",
-  "modified": "2022-07-22T00:00:34Z",
+  "modified": "2022-07-27T00:00:37Z",
  "published": "2022-07-22T00:00:34Z",
  "aliases": [
    "CVE-2022-20885"
  ],
  "details": "Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition. These vulnerabilities are due to insufficient validation of user fields within incoming HTTP packets. An attacker could exploit these vulnerabilities by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on an affected device with root-level privileges or to cause the device to restart unexpectedly, resulting in a DoS condition. To exploit these vulnerabilities, an attacker would need to have valid Administrator credentials on the affected device. Cisco has not released software updates that address these vulnerabilities.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-78"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false
  }
 }
@@ -0,0 +1,37 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-2cw2-wqm2-wwp4",
+  "modified": "2022-07-27T00:00:32Z",
+  "published": "2022-07-27T00:00:32Z",
+  "aliases": [
+    "CVE-2022-29965"
+  ],
+  "details": "The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M-series and SIS (CSLS/LSNB/LSNG) nodes is controlled by means of utility passwords. These passwords are generated using a deterministic, insecure algorithm using a single seed value composed of a day/hour/minute timestamp with less than 16 bits of entropy. The seed value is fed through a lookup table and a series of permutation operations resulting in three different four-character passwords corresponding to different privilege levels. An attacker can easily reconstruct these passwords and thus gain access to privileged maintenance operations. NOTE: this is different from CVE-2014-2350.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29965"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.forescout.com/blog/"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-2cxw-4p8f-4qp7",
-  "modified": "2022-07-20T00:00:18Z",
+  "modified": "2022-07-27T00:00:31Z",
  "published": "2022-07-20T00:00:18Z",
  "aliases": [
    "CVE-2022-1922"
  ],
  "details": "DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-787"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false
  }
 }
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-2j64-wxj4-5fr9",
-  "modified": "2022-07-23T00:00:24Z",
+  "modified": "2022-07-27T00:00:44Z",
  "published": "2022-07-23T00:00:24Z",
  "aliases": [
    "CVE-2022-20910"
  ],
  "details": "Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition. These vulnerabilities are due to insufficient validation of user fields within incoming HTTP packets. An attacker could exploit these vulnerabilities by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on an affected device with root-level privileges or to cause the device to restart unexpectedly, resulting in a DoS condition. To exploit these vulnerabilities, an attacker would need to have valid Administrator credentials on the affected device. Cisco has not released software updates that address these vulnerabilities.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-78"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false
  }
 }
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-2jw2-755p-5gqq",
-  "modified": "2022-07-20T00:00:18Z",
+  "modified": "2022-07-27T00:00:31Z",
  "published": "2022-07-20T00:00:18Z",
  "aliases": [
    "CVE-2022-34534"
  ],
  "details": "Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-200"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false
  }
 }
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-2pxw-qgwm-32jg",
-  "modified": "2022-07-22T00:00:32Z",
+  "modified": "2022-07-27T00:00:44Z",
  "published": "2022-07-22T00:00:32Z",
  "aliases": [
    "CVE-2022-34487"
  ],
  "details": "Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-863"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false
  }
 }
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-2r7c-m53q-845g",
-  "modified": "2022-07-22T00:00:40Z",
+  "modified": "2022-07-27T00:00:38Z",
  "published": "2022-07-22T00:00:40Z",
  "aliases": [
    "CVE-2022-20880"
  ],
  "details": "Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition. These vulnerabilities are due to insufficient validation of user fields within incoming HTTP packets. An attacker could exploit these vulnerabilities by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on an affected device with root-level privileges or to cause the device to restart unexpectedly, resulting in a DoS condition. To exploit these vulnerabilities, an attacker would need to have valid Administrator credentials on the affected device. Cisco has not released software updates that address these vulnerabilities.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-78"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false
  }
 }
@@ -0,0 +1,37 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-32j7-h4wq-r683",
+  "modified": "2022-07-27T00:00:33Z",
+  "published": "2022-07-27T00:00:33Z",
+  "aliases": [
+    "CVE-2022-1491"
+  ],
+  "details": "Use after free in Bookmarks in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct user interaction.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1491"
+    },
+    {
+      "type": "WEB",
+      "url": "https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://crbug.com/1305706"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false
+  }
+}
@@ -0,0 +1,37 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-38f8-6mx5-p5qh",
+  "modified": "2022-07-27T00:00:32Z",
+  "published": "2022-07-27T00:00:32Z",
+  "aliases": [
+    "CVE-2022-1640"
+  ],
+  "details": "Use after free in Sharing in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1640"
+    },
+    {
+      "type": "WEB",
+      "url": "https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://crbug.com/1320592"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false
+  }
+}
@@ -25,6 +25,10 @@
      "type": "WEB",
      "url": "https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/"
+    },
    {
      "type": "WEB",
      "url": "https://lua-users.org/lists/lua-l/2022-05/msg00035.html"
@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.2.0",
+  "id": "GHSA-39rf-5f5g-vgx4",
+  "modified": "2022-07-27T00:00:36Z",
+  "published": "2022-07-27T00:00:36Z",
+  "aliases": [
+    "CVE-2022-1651"
+  ],
+  "details": "A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function in how the ACRN Device Model emulates virtual NICs in VM. This flaw allows a local privileged attacker to leak unauthorized kernel information, causing a denial of service.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1651"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ecd1735f14d6ac868ae5d8b7a2bf193fa11f388b"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.2.0",
  "id": "GHSA-3c4j-vv65-mwcv",
-  "modified": "2022-07-21T00:00:33Z",
+  "modified": "2022-07-27T00:00:32Z",
  "published": "2022-07-21T00:00:33Z",
  "aliases": [
    "CVE-2022-2492"
  ],
  "details": "A vulnerability was found in SourceCodester Library Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /index.php. The manipulation of the argument RollNo with the input admin' AND (SELECT 2625 FROM (SELECT(SLEEP(5)))MdIL) AND 'KXmq'='KXmq&Password=1231312312 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-89"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false
  }
 }
--- a/Show More
+++ b/Show More