diff --git a/advisories/github-reviewed/2022/05/GHSA-7c4h-w765-6pwg/GHSA-7c4h-w765-6pwg.json b/advisories/github-reviewed/2022/05/GHSA-7c4h-w765-6pwg/GHSA-7c4h-w765-6pwg.json index 2932fd06ff4..db5bb1f9ac1 100644 --- a/advisories/github-reviewed/2022/05/GHSA-7c4h-w765-6pwg/GHSA-7c4h-w765-6pwg.json +++ b/advisories/github-reviewed/2022/05/GHSA-7c4h-w765-6pwg/GHSA-7c4h-w765-6pwg.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7c4h-w765-6pwg", - "modified": "2024-02-23T20:56:20Z", + "modified": "2024-10-28T14:41:27Z", "published": "2022-05-14T03:22:02Z", "aliases": [ "CVE-2018-1000167" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ @@ -55,6 +59,10 @@ "type": "PACKAGE", "url": "https://github.com/OISF/suricata-update" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/suricata-update/PYSEC-2018-75.yaml" + }, { "type": "WEB", "url": "https://redmine.openinfosecfoundation.org/issues/2359" diff --git a/advisories/github-reviewed/2022/05/GHSA-hfg2-wf6j-x53p/GHSA-hfg2-wf6j-x53p.json b/advisories/github-reviewed/2022/05/GHSA-hfg2-wf6j-x53p/GHSA-hfg2-wf6j-x53p.json index f08b1ec2bc0..0190f52c1ff 100644 --- a/advisories/github-reviewed/2022/05/GHSA-hfg2-wf6j-x53p/GHSA-hfg2-wf6j-x53p.json +++ b/advisories/github-reviewed/2022/05/GHSA-hfg2-wf6j-x53p/GHSA-hfg2-wf6j-x53p.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hfg2-wf6j-x53p", - "modified": "2024-04-30T08:33:05Z", + "modified": "2024-10-28T14:40:40Z", "published": "2022-05-14T03:49:27Z", "aliases": [ "CVE-2012-0805" @@ -9,7 +9,14 @@ "summary": "SQLAlchemy vulnerable to SQL injection", "details": "Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -49,6 +56,10 @@ "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73756" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/sqlalchemy/PYSEC-2012-9.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/sqlalchemy/sqlalchemy" @@ -73,10 +84,6 @@ "type": "WEB", "url": "http://www.debian.org/security/2012/dsa-2449" }, - { - "type": "WEB", - "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:059" - }, { "type": "WEB", "url": "http://www.sqlalchemy.org/changelog/CHANGES_0_7_0" @@ -90,7 +97,7 @@ "cwe_ids": [ "CWE-89" ], - "severity": "HIGH", + "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2024-04-30T08:33:05Z", "nvd_published_at": "2012-06-05T22:55:00Z" diff --git a/advisories/unreviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json b/advisories/github-reviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json similarity index 59% rename from advisories/unreviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json rename to advisories/github-reviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json index 4b8c98a1cc1..2bf60afde4f 100644 --- a/advisories/unreviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json +++ b/advisories/github-reviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json @@ -1,20 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-w455-mfq9-hf74", - "modified": "2024-10-26T21:30:46Z", + "modified": "2024-10-28T14:40:03Z", "published": "2024-10-26T21:30:46Z", "aliases": [ "CVE-2020-26303" ], + "summary": "insane vulnerable to Regular Expression Denial of Service", "details": "insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.", "severity": [ { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green" } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "insane" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.6.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/bevacqua/insane/issues/19" }, + { + "type": "PACKAGE", + "url": "https://github.com/bevacqua/insane" + }, { "type": "ADVISORY", "url": "https://securitylab.github.com/advisories/GHSL-2020-289-redos-insane" @@ -34,9 +57,9 @@ "cwe_ids": [ "CWE-1333" ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-28T14:40:03Z", "nvd_published_at": "2024-10-26T21:15:13Z" } } \ No newline at end of file