diff --git a/advisories/github-reviewed/2022/05/GHSA-f9qv-j5g6-g5cr/GHSA-f9qv-j5g6-g5cr.json b/advisories/github-reviewed/2022/05/GHSA-f9qv-j5g6-g5cr/GHSA-f9qv-j5g6-g5cr.json index 9d9b9b747af..5ce38b4e266 100644 --- a/advisories/github-reviewed/2022/05/GHSA-f9qv-j5g6-g5cr/GHSA-f9qv-j5g6-g5cr.json +++ b/advisories/github-reviewed/2022/05/GHSA-f9qv-j5g6-g5cr/GHSA-f9qv-j5g6-g5cr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-f9qv-j5g6-g5cr", - "modified": "2024-04-29T14:39:46Z", + "modified": "2024-11-18T21:04:24Z", "published": "2022-05-02T03:54:25Z", "aliases": [ "CVE-2009-4405" @@ -45,6 +45,10 @@ "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54983" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/trac/PYSEC-2009-7.yaml" + }, { "type": "WEB", "url": "https://web.archive.org/web/20130417170303/http://secunia.com/advisories/37901" diff --git a/advisories/github-reviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json b/advisories/github-reviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json new file mode 100644 index 00000000000..eeb4ab50547 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json @@ -0,0 +1,124 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f632-9449-3j4w", + "modified": "2024-11-18T21:03:24Z", + "published": "2024-11-18T15:33:20Z", + "aliases": [ + "CVE-2024-52318" + ], + "summary": "Apache Tomcat - XSS in generated JSPs", + "details": "# Description:\nThe fix for improvement 69333 caused pooled JSP tags not to be released after use which in turn could cause output of some tags not to escaped as expected. This unescaped output could lead to XSS.\n\n# Versions Affected:\n- Apache Tomcat 11.0.0\n- Apache Tomcat 10.1.31\n- Apache Tomcat 9.0.96\n\n# Mitigation:\nUsers of the affected versions should apply one of the following\nmitigations:\n- Upgrade to Apache Tomcat 11.0.1 or later\n- Upgrade to Apache Tomcat 10.1.33 or later\nNote: 10.1.32 was not released\n- Upgrade to Apache Tomcat 9.0.97 or later", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat-jasper" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0" + }, + { + "fixed": "11.0.1" + } + ] + } + ], + "versions": [ + "11.0.0" + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat-jasper" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.31" + }, + { + "fixed": "10.1.32" + } + ] + } + ], + "versions": [ + "10.1.31" + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat-jasper" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.96" + }, + { + "fixed": "9.0.97" + } + ] + } + ], + "versions": [ + "9.0.96" + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52318" + }, + { + "type": "WEB", + "url": "https://github.com/apache/tomcat/commit/8d1fc4733a06d1a03b9d644c57010f2ec5f0df38" + }, + { + "type": "WEB", + "url": "https://github.com/apache/tomcat/commit/9813c5dd3259183f659bbb83312a5cf673cc1ebf" + }, + { + "type": "WEB", + "url": "https://github.com/apache/tomcat/commit/be8e32143a3159e78fe5463d09bb8e1b33bf2b1f" + }, + { + "type": "WEB", + "url": "https://bz.apache.org/bugzilla/show_bug.cgi?id=69333" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/tomcat" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/co243cw1nlh6p521c5265cm839wkqdp9" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-326" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T21:03:24Z", + "nvd_published_at": "2024-11-18T13:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-q297-5ff8-hc92/GHSA-q297-5ff8-hc92.json b/advisories/github-reviewed/2024/11/GHSA-q297-5ff8-hc92/GHSA-q297-5ff8-hc92.json similarity index 61% rename from advisories/unreviewed/2024/11/GHSA-q297-5ff8-hc92/GHSA-q297-5ff8-hc92.json rename to advisories/github-reviewed/2024/11/GHSA-q297-5ff8-hc92/GHSA-q297-5ff8-hc92.json index cc25055c02f..5d70f056e7c 100644 --- a/advisories/unreviewed/2024/11/GHSA-q297-5ff8-hc92/GHSA-q297-5ff8-hc92.json +++ b/advisories/github-reviewed/2024/11/GHSA-q297-5ff8-hc92/GHSA-q297-5ff8-hc92.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-q297-5ff8-hc92", - "modified": "2024-11-15T06:30:33Z", + "modified": "2024-11-18T21:03:34Z", "published": "2024-11-15T06:30:33Z", "aliases": [ "CVE-2024-42499" ], + "summary": "FitNesse Path Traversal", "details": "Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specific conditions.", "severity": [ { @@ -14,17 +15,43 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.fitnesse:fitnesse" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "20241026" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42499" }, + { + "type": "WEB", + "url": "https://github.com/unclebob/fitnesse/commit/850c599e5177d6f877af063374086f3e36b4b956" + }, { "type": "WEB", "url": "https://fitnesse.org/FitNesseDownload" }, + { + "type": "PACKAGE", + "url": "https://github.com/unclebob/fitnesse" + }, { "type": "WEB", "url": "https://github.com/unclebob/fitnesse/releases/tag/20241026" @@ -39,8 +66,8 @@ "CWE-22" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T21:03:34Z", "nvd_published_at": "2024-11-15T06:15:04Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json b/advisories/unreviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json deleted file mode 100644 index 0c416186115..00000000000 --- a/advisories/unreviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-f632-9449-3j4w", - "modified": "2024-11-18T18:30:55Z", - "published": "2024-11-18T15:33:20Z", - "aliases": [ - "CVE-2024-52318" - ], - "details": "Incorrect object recycling and reuse vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96.\n\nUsers are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52318" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/co243cw1nlh6p521c5265cm839wkqdp9" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-326" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-11-18T13:15:04Z" - } -} \ No newline at end of file