diff --git a/advisories/unreviewed/2024/02/GHSA-6v6w-h8m6-7mv2/GHSA-6v6w-h8m6-7mv2.json b/advisories/github-reviewed/2024/02/GHSA-6v6w-h8m6-7mv2/GHSA-6v6w-h8m6-7mv2.json similarity index 56% rename from advisories/unreviewed/2024/02/GHSA-6v6w-h8m6-7mv2/GHSA-6v6w-h8m6-7mv2.json rename to advisories/github-reviewed/2024/02/GHSA-6v6w-h8m6-7mv2/GHSA-6v6w-h8m6-7mv2.json index 98b333d40ae..1a5e042b0f0 100644 --- a/advisories/unreviewed/2024/02/GHSA-6v6w-h8m6-7mv2/GHSA-6v6w-h8m6-7mv2.json +++ b/advisories/github-reviewed/2024/02/GHSA-6v6w-h8m6-7mv2/GHSA-6v6w-h8m6-7mv2.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-6v6w-h8m6-7mv2", - "modified": "2024-02-29T12:31:06Z", + "modified": "2024-02-29T23:27:11Z", "published": "2024-02-29T12:31:06Z", "aliases": [ "CVE-2024-27906" ], + "summary": "Apache Airflow: DAG Code and Import Error Permissions Ignored", "details": "Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI.\n\nUsers of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability\n", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "apache-airflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.8.1" + } + } ], "references": [ { @@ -26,18 +48,26 @@ "type": "WEB", "url": "https://github.com/apache/airflow/pull/37468" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/airflow" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/02/29/1" } ], "database_specific": { "cwe_ids": [ "CWE-668" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T23:27:11Z", "nvd_published_at": "2024-02-29T11:15:08Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json b/advisories/github-reviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json similarity index 69% rename from advisories/unreviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json rename to advisories/github-reviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json index 79929e08bfc..b3d352ae701 100644 --- a/advisories/unreviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json +++ b/advisories/github-reviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-q76r-7p4q-mqpw", - "modified": "2024-02-29T15:32:26Z", + "modified": "2024-02-29T23:27:17Z", "published": "2024-02-29T15:32:26Z", "aliases": [ "CVE-2024-2001" ], + "summary": "Cockpit CMS Cross-Site Scripting vulnerability", "details": "A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. This vulnerability could allow an authenticated user to upload an infected PDF file and store a malicious JavaScript payload to be executed when the file is uploaded.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "cockpit-hq/cockpit" + }, + "versions": [ + "2.7.0" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2001" }, + { + "type": "PACKAGE", + "url": "https://github.com/Cockpit-HQ/Cockpit" + }, { "type": "WEB", "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cockpit-cms" @@ -31,8 +44,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T23:27:17Z", "nvd_published_at": "2024-02-29T14:15:45Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-vf7j-cmrj-pmmm/GHSA-vf7j-cmrj-pmmm.json b/advisories/github-reviewed/2024/02/GHSA-vf7j-cmrj-pmmm/GHSA-vf7j-cmrj-pmmm.json index fe821934c68..531fc5b3590 100644 --- a/advisories/github-reviewed/2024/02/GHSA-vf7j-cmrj-pmmm/GHSA-vf7j-cmrj-pmmm.json +++ b/advisories/github-reviewed/2024/02/GHSA-vf7j-cmrj-pmmm/GHSA-vf7j-cmrj-pmmm.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vf7j-cmrj-pmmm", - "modified": "2024-02-27T21:54:56Z", + "modified": "2024-02-29T23:26:54Z", "published": "2024-02-27T15:30:33Z", "aliases": [ "CVE-2024-25723" ], - "summary": "ZenML vulnerable to remote privilege escalation", + "summary": "ZenML Server Remote Privilege Escalation Vulnerability", "details": "ZenML Server in the ZenML package before 0.46.7 for Python allows remote privilege escalation because the `/api/v1/users/{user_name_or_id}/activate` REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.", "severity": [ @@ -63,16 +63,13 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0.44.0" + "introduced": "0.45.0" }, { - "fixed": "0.44.1" + "fixed": "0.46.7" } ] } - ], - "versions": [ - "0.44.0" ] }, { @@ -85,10 +82,10 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0.45.0" + "introduced": "0.44.0" }, { - "fixed": "0.46.7" + "fixed": "0.44.4" } ] }