Publish Advisories

GHSA-7c4h-w765-6pwg
GHSA-hfg2-wf6j-x53p
GHSA-w455-mfq9-hf74

advisories/github-reviewed/2022/05/GHSA-7c4h-w765-6pwg/GHSA-7c4h-w765-6pwg.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7c4h-w765-6pwg",
-  "modified": "2024-02-23T20:56:20Z",
+  "modified": "2024-10-28T14:41:27Z",
   "published": "2022-05-14T03:22:02Z",
   "aliases": [
     "CVE-2018-1000167"
@@ -12,6 +12,10 @@
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [
@@ -55,6 +59,10 @@
       "type": "PACKAGE",
       "url": "https://github.com/OISF/suricata-update"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/suricata-update/PYSEC-2018-75.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://redmine.openinfosecfoundation.org/issues/2359"

advisories/github-reviewed/2022/05/GHSA-hfg2-wf6j-x53p/GHSA-hfg2-wf6j-x53p.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hfg2-wf6j-x53p",
-  "modified": "2024-04-30T08:33:05Z",
+  "modified": "2024-10-28T14:40:40Z",
   "published": "2022-05-14T03:49:27Z",
   "aliases": [
     "CVE-2012-0805"
@@ -9,7 +9,14 @@
   "summary": "SQLAlchemy vulnerable to SQL injection",
   "details": "Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -49,6 +56,10 @@
       "type": "WEB",
       "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73756"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/sqlalchemy/PYSEC-2012-9.yaml"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/sqlalchemy/sqlalchemy"
@@ -73,10 +84,6 @@
       "type": "WEB",
       "url": "http://www.debian.org/security/2012/dsa-2449"
     },
-    {
-      "type": "WEB",
-      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:059"
-    },
     {
       "type": "WEB",
       "url": "http://www.sqlalchemy.org/changelog/CHANGES_0_7_0"
@@ -90,7 +97,7 @@
     "cwe_ids": [
       "CWE-89"
     ],
-    "severity": "HIGH",
+    "severity": "CRITICAL",
     "github_reviewed": true,
     "github_reviewed_at": "2024-04-30T08:33:05Z",
     "nvd_published_at": "2012-06-05T22:55:00Z"

advisories/github-reviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json

@@ -1,20 +1,39 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-w455-mfq9-hf74",
-  "modified": "2024-10-26T21:30:46Z",
+  "modified": "2024-10-28T14:40:03Z",
   "published": "2024-10-26T21:30:46Z",
   "aliases": [
     "CVE-2020-26303"
   ],
+  "summary": "insane vulnerable to Regular Expression Denial of Service",
   "details": "insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.",
   "severity": [
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green"
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green"
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "insane"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "2.6.2"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -25,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/bevacqua/insane/issues/19"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/bevacqua/insane"
+    },
     {
       "type": "ADVISORY",
       "url": "https://securitylab.github.com/advisories/GHSL-2020-289-redos-insane"
@@ -34,9 +57,9 @@
     "cwe_ids": [
       "CWE-1333"
     ],
-    "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-28T14:40:03Z",
     "nvd_published_at": "2024-10-26T21:15:13Z"
   }
 }