diff --git a/advisories/github-reviewed/2020/05/GHSA-r854-96gq-rfg3/GHSA-r854-96gq-rfg3.json b/advisories/github-reviewed/2020/05/GHSA-r854-96gq-rfg3/GHSA-r854-96gq-rfg3.json index a613afe3932..ffa26e97590 100644 --- a/advisories/github-reviewed/2020/05/GHSA-r854-96gq-rfg3/GHSA-r854-96gq-rfg3.json +++ b/advisories/github-reviewed/2020/05/GHSA-r854-96gq-rfg3/GHSA-r854-96gq-rfg3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-r854-96gq-rfg3", - "modified": "2023-09-05T09:25:57Z", + "modified": "2024-10-09T19:50:16Z", "published": "2020-05-18T17:41:19Z", "aliases": [ "CVE-2014-1933" @@ -9,13 +9,20 @@ "summary": "Pillow Temporary file name leakage", "details": "The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "Pillow" + "name": "pillow" }, "ranges": [ { @@ -41,6 +48,14 @@ "type": "WEB", "url": "https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7" }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-r854-96gq-rfg3" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-23.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/python-imaging/Pillow" @@ -61,10 +76,6 @@ "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2014/02/11/1" }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/65513" - }, { "type": "WEB", "url": "http://www.ubuntu.com/usn/USN-2168-1" @@ -74,7 +85,7 @@ "cwe_ids": [ ], - "severity": "LOW", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2020-05-18T17:41:04Z", "nvd_published_at": null diff --git a/advisories/github-reviewed/2024/09/GHSA-wmjg-vqhv-q5p5/GHSA-wmjg-vqhv-q5p5.json b/advisories/github-reviewed/2024/09/GHSA-wmjg-vqhv-q5p5/GHSA-wmjg-vqhv-q5p5.json index b8223c99a29..b3195a9a098 100644 --- a/advisories/github-reviewed/2024/09/GHSA-wmjg-vqhv-q5p5/GHSA-wmjg-vqhv-q5p5.json +++ b/advisories/github-reviewed/2024/09/GHSA-wmjg-vqhv-q5p5/GHSA-wmjg-vqhv-q5p5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wmjg-vqhv-q5p5", - "modified": "2024-09-18T19:24:03Z", + "modified": "2024-10-09T19:48:58Z", "published": "2024-09-18T14:39:03Z", "aliases": [ "CVE-2024-46986" @@ -60,6 +60,10 @@ "type": "PACKAGE", "url": "https://github.com/owen2345/camaleon-cms" }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2024-46986.yml" + }, { "type": "WEB", "url": "https://owasp.org/www-community/attacks/Path_Traversal"