diff --git a/advisories/github-reviewed/2020/09/GHSA-x5cp-9pcf-pp3h/GHSA-x5cp-9pcf-pp3h.json b/advisories/github-reviewed/2020/09/GHSA-x5cp-9pcf-pp3h/GHSA-x5cp-9pcf-pp3h.json index 417dd3efbd4..2d93723823b 100644 --- a/advisories/github-reviewed/2020/09/GHSA-x5cp-9pcf-pp3h/GHSA-x5cp-9pcf-pp3h.json +++ b/advisories/github-reviewed/2020/09/GHSA-x5cp-9pcf-pp3h/GHSA-x5cp-9pcf-pp3h.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-x5cp-9pcf-pp3h", - "modified": "2021-08-26T15:11:57Z", + "modified": "2024-10-28T14:51:46Z", "published": "2020-09-25T18:28:24Z", "aliases": [ "CVE-2020-15199" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ @@ -95,6 +99,18 @@ "type": "WEB", "url": "https://github.com/tensorflow/tensorflow/commit/3cbb917b4714766030b28eba9fb41bb97ce9ee02" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-279.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-314.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-122.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/tensorflow/tensorflow" @@ -108,7 +124,7 @@ "cwe_ids": [ "CWE-20" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-09-25T16:59:30Z", "nvd_published_at": "2020-09-25T19:15:00Z" diff --git a/advisories/unreviewed/2024/10/GHSA-rv73-9c8w-jp4c/GHSA-rv73-9c8w-jp4c.json b/advisories/github-reviewed/2024/10/GHSA-rv73-9c8w-jp4c/GHSA-rv73-9c8w-jp4c.json similarity index 60% rename from advisories/unreviewed/2024/10/GHSA-rv73-9c8w-jp4c/GHSA-rv73-9c8w-jp4c.json rename to advisories/github-reviewed/2024/10/GHSA-rv73-9c8w-jp4c/GHSA-rv73-9c8w-jp4c.json index bccba7a6cd9..1ba672d66cc 100644 --- a/advisories/unreviewed/2024/10/GHSA-rv73-9c8w-jp4c/GHSA-rv73-9c8w-jp4c.json +++ b/advisories/github-reviewed/2024/10/GHSA-rv73-9c8w-jp4c/GHSA-rv73-9c8w-jp4c.json @@ -1,20 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-rv73-9c8w-jp4c", - "modified": "2024-10-26T21:30:46Z", + "modified": "2024-10-28T14:51:32Z", "published": "2024-10-26T21:30:46Z", "aliases": [ "CVE-2020-26308" ], + "summary": "validate.js Regular Expression Denial of Service vulnerability", "details": "Validate.js provides a declarative way of validating javascript objects. Versions 0.13.1 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.", "severity": [ { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green" } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "validate.js" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.13.1" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/ansman/validate.js/issues/342" }, + { + "type": "PACKAGE", + "url": "https://github.com/ansman/validate.js" + }, { "type": "ADVISORY", "url": "https://securitylab.github.com/advisories/GHSL-2020-302-redos-validate.js" @@ -34,9 +57,9 @@ "cwe_ids": [ "CWE-1333" ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-28T14:51:32Z", "nvd_published_at": "2024-10-26T21:15:14Z" } } \ No newline at end of file