From a7b96efeb1203177896495ad26cd5fe0b7f66f6a Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 14 May 2024 17:25:51 +0000 Subject: [PATCH] Publish Advisories GHSA-4j3w-g62x-hrcp GHSA-grm6-x6mr-q3cv --- .../GHSA-4j3w-g62x-hrcp.json | 33 ++++++++-- .../GHSA-grm6-x6mr-q3cv.json | 64 +++++++++++++++++-- 2 files changed, 88 insertions(+), 9 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-4j3w-g62x-hrcp/GHSA-4j3w-g62x-hrcp.json (58%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-grm6-x6mr-q3cv/GHSA-grm6-x6mr-q3cv.json (59%) diff --git a/advisories/unreviewed/2022/05/GHSA-4j3w-g62x-hrcp/GHSA-4j3w-g62x-hrcp.json b/advisories/github-reviewed/2022/05/GHSA-4j3w-g62x-hrcp/GHSA-4j3w-g62x-hrcp.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-4j3w-g62x-hrcp/GHSA-4j3w-g62x-hrcp.json rename to advisories/github-reviewed/2022/05/GHSA-4j3w-g62x-hrcp/GHSA-4j3w-g62x-hrcp.json index 6f67b9ff09c..dd6e5d2117d 100644 --- a/advisories/unreviewed/2022/05/GHSA-4j3w-g62x-hrcp/GHSA-4j3w-g62x-hrcp.json +++ b/advisories/github-reviewed/2022/05/GHSA-4j3w-g62x-hrcp/GHSA-4j3w-g62x-hrcp.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-4j3w-g62x-hrcp", - "modified": "2022-05-01T23:28:05Z", + "modified": "2024-05-14T17:23:26Z", "published": "2022-05-01T23:28:05Z", "aliases": [ "CVE-2008-0164" ], - "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page.", + "summary": "Plone Cross-site request forgery (CSRF)", + "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS before 3.1 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "Plone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.1" + } + ] + } + ] + } ], "references": [ { @@ -26,6 +45,10 @@ "type": "WEB", "url": "http://plone.org/about/security/advisories/cve-2008-0164" }, + { + "type": "WEB", + "url": "http://plone.org/products/plone-hotfix/releases/CVE-2008-0164" + }, { "type": "WEB", "url": "http://secunia.com/advisories/29361" @@ -48,8 +71,8 @@ "CWE-352" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T17:23:26Z", "nvd_published_at": "2008-03-20T00:44:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-grm6-x6mr-q3cv/GHSA-grm6-x6mr-q3cv.json b/advisories/github-reviewed/2022/05/GHSA-grm6-x6mr-q3cv/GHSA-grm6-x6mr-q3cv.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-grm6-x6mr-q3cv/GHSA-grm6-x6mr-q3cv.json rename to advisories/github-reviewed/2022/05/GHSA-grm6-x6mr-q3cv/GHSA-grm6-x6mr-q3cv.json index 38fa060849f..4d78d7d97ea 100644 --- a/advisories/unreviewed/2022/05/GHSA-grm6-x6mr-q3cv/GHSA-grm6-x6mr-q3cv.json +++ b/advisories/github-reviewed/2022/05/GHSA-grm6-x6mr-q3cv/GHSA-grm6-x6mr-q3cv.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-grm6-x6mr-q3cv", - "modified": "2022-05-13T01:07:34Z", + "modified": "2024-05-14T17:25:12Z", "published": "2022-05-13T01:07:34Z", "aliases": [ "CVE-2016-4428" ], + "summary": "OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability", "details": "Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.", "severity": [ { @@ -14,13 +15,68 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "horizon" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 8.0.1" + } + }, + { + "package": { + "ecosystem": "PyPI", + "name": "horizon" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.1.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 9.0.1" + } + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4428" }, + { + "type": "WEB", + "url": "https://github.com/openstack/horizon/commit/62b4e6f30a7ae7961805abdffdb3c7ae5c2b676a" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/horizon/commit/d585e5eb9acf92d10d39b6c2038917a7e8ac71bb" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/horizon/commit/fc8d70560401f3985e5672a4c580f10d51e985a4" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2016:1268" @@ -83,8 +139,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T17:25:11Z", "nvd_published_at": "2016-07-12T19:59:00Z" } } \ No newline at end of file