Publish Advisories

GHSA-4j3w-g62x-hrcp
GHSA-grm6-x6mr-q3cv

advisories/github-reviewed/2022/05/GHSA-4j3w-g62x-hrcp/GHSA-4j3w-g62x-hrcp.json

@@ -1,17 +1,36 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4j3w-g62x-hrcp",
-  "modified": "2022-05-01T23:28:05Z",
+  "modified": "2024-05-14T17:23:26Z",
   "published": "2022-05-01T23:28:05Z",
   "aliases": [
     "CVE-2008-0164"
   ],
-  "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page.",
+  "summary": "Plone Cross-site request forgery (CSRF)",
+  "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS before 3.1 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page.",
   "severity": [
 
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "Plone"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.1"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -26,6 +45,10 @@
       "type": "WEB",
       "url": "http://plone.org/about/security/advisories/cve-2008-0164"
     },
+    {
+      "type": "WEB",
+      "url": "http://plone.org/products/plone-hotfix/releases/CVE-2008-0164"
+    },
     {
       "type": "WEB",
       "url": "http://secunia.com/advisories/29361"
@@ -48,8 +71,8 @@
       "CWE-352"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-14T17:23:26Z",
     "nvd_published_at": "2008-03-20T00:44:00Z"
   }
 }

advisories/github-reviewed/2022/05/GHSA-grm6-x6mr-q3cv/GHSA-grm6-x6mr-q3cv.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-grm6-x6mr-q3cv",
-  "modified": "2022-05-13T01:07:34Z",
+  "modified": "2024-05-14T17:25:12Z",
   "published": "2022-05-13T01:07:34Z",
   "aliases": [
     "CVE-2016-4428"
   ],
+  "summary": "OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability",
   "details": "Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.",
   "severity": [
     {
@@ -14,13 +15,68 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "horizon"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "8.0.2"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 8.0.1"
+      }
+    },
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "horizon"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "9.0.0"
+            },
+            {
+              "fixed": "9.1.0"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 9.0.1"
+      }
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4428"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/openstack/horizon/commit/62b4e6f30a7ae7961805abdffdb3c7ae5c2b676a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/openstack/horizon/commit/d585e5eb9acf92d10d39b6c2038917a7e8ac71bb"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/openstack/horizon/commit/fc8d70560401f3985e5672a4c580f10d51e985a4"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2016:1268"
@@ -83,8 +139,8 @@
       "CWE-79"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-14T17:25:11Z",
     "nvd_published_at": "2016-07-12T19:59:00Z"
   }
 }