Publish Advisories

GHSA-6v6w-h8m6-7mv2
GHSA-q76r-7p4q-mqpw
GHSA-vf7j-cmrj-pmmm

advisories/github-reviewed/2024/02/GHSA-6v6w-h8m6-7mv2/GHSA-6v6w-h8m6-7mv2.json

@@ -1,17 +1,39 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6v6w-h8m6-7mv2",
-  "modified": "2024-02-29T12:31:06Z",
+  "modified": "2024-02-29T23:27:11Z",
   "published": "2024-02-29T12:31:06Z",
   "aliases": [
     "CVE-2024-27906"
   ],
+  "summary": "Apache Airflow: DAG Code and Import Error Permissions Ignored",
   "details": "Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI.\n\nUsers of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability\n",
   "severity": [
 
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "apache-airflow"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.8.2"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 2.8.1"
+      }
+    }
   ],
   "references": [
     {
@@ -26,18 +48,26 @@
       "type": "WEB",
       "url": "https://github.com/apache/airflow/pull/37468"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/airflow"
+    },
     {
       "type": "WEB",
       "url": "https://lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2024/02/29/1"
     }
   ],
   "database_specific": {
     "cwe_ids": [
       "CWE-668"
     ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-02-29T23:27:11Z",
     "nvd_published_at": "2024-02-29T11:15:08Z"
   }
 }

advisories/github-reviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-q76r-7p4q-mqpw",
-  "modified": "2024-02-29T15:32:26Z",
+  "modified": "2024-02-29T23:27:17Z",
   "published": "2024-02-29T15:32:26Z",
   "aliases": [
     "CVE-2024-2001"
   ],
+  "summary": "Cockpit CMS Cross-Site Scripting vulnerability",
   "details": "A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. This vulnerability could allow an authenticated user to upload an infected PDF file and store a malicious JavaScript payload to be executed when the file is uploaded.",
   "severity": [
     {
@@ -14,13 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "cockpit-hq/cockpit"
+      },
+      "versions": [
+        "2.7.0"
+      ]
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2001"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Cockpit-HQ/Cockpit"
+    },
     {
       "type": "WEB",
       "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cockpit-cms"
@@ -31,8 +44,8 @@
       "CWE-79"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-02-29T23:27:17Z",
     "nvd_published_at": "2024-02-29T14:15:45Z"
   }
 }

advisories/github-reviewed/2024/02/GHSA-vf7j-cmrj-pmmm/GHSA-vf7j-cmrj-pmmm.json

@@ -1,12 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vf7j-cmrj-pmmm",
-  "modified": "2024-02-27T21:54:56Z",
+  "modified": "2024-02-29T23:26:54Z",
   "published": "2024-02-27T15:30:33Z",
   "aliases": [
     "CVE-2024-25723"
   ],
-  "summary": "ZenML vulnerable to remote privilege escalation",
+  "summary": "ZenML Server Remote Privilege Escalation Vulnerability",
   "details": "ZenML Server in the ZenML package before 0.46.7 for Python allows remote privilege escalation because the `/api/v1/users/{user_name_or_id}/activate` REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.",
   "severity": [
 
@@ -63,16 +63,13 @@
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "0.44.0"
+              "introduced": "0.45.0"
             },
             {
-              "fixed": "0.44.1"
+              "fixed": "0.46.7"
             }
           ]
         }
-      ],
-      "versions": [
-        "0.44.0"
       ]
     },
     {
@@ -85,10 +82,10 @@
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "0.45.0"
+              "introduced": "0.44.0"
             },
             {
-              "fixed": "0.46.7"
+              "fixed": "0.44.4"
             }
           ]
         }