Publish Advisories

GHSA-2j2j-8rrv-264g
GHSA-chqj-j4fh-rw7m

advisories/github-reviewed/2018/09/GHSA-2j2j-8rrv-264g/GHSA-2j2j-8rrv-264g.json

@@ -1,15 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2j2j-8rrv-264g",
-  "modified": "2020-08-31T18:33:49Z",
+  "modified": "2023-09-13T18:50:53Z",
   "published": "2018-09-11T18:58:40Z",
   "aliases": [
     "CVE-2018-16459"
   ],
   "summary": "Cross-Site Scripting in exceljs",
-  "details": "Versions of `exceljs` before 1.6.0 are vulnerable to cross-site scripting. \n\nThis vulnerability is due to `exceljs` does not  validate data from parsed XLSX file and allows to embed HTML tags, like `<script>`, directly in the sheet cells. Because of this it's possible to inject malicious JavaScript code and execute it when data from the sheet were displayed in the browser.\n\n\n\n\n## Recommendation\n\nUpdate to version 1.6.0 or later.",
+  "details": "Versions of `exceljs` before 1.6.0 are vulnerable to cross-site scripting. \n\nThis vulnerability is due to `exceljs` not validating data from parsed XLSX file and embedding HTML tags, like `<script>` directly into the sheet cells. Because of this it's possible to inject malicious JavaScript code and execute it when data from the sheet is displayed in the browser.\n\n\n\n\n## Recommendation\n\nUpdate to version 1.6.0 or later.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
   ],
   "affected": [
     {
@@ -17,6 +20,11 @@
         "ecosystem": "npm",
         "name": "exceljs"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",

advisories/github-reviewed/2020/08/GHSA-chqj-j4fh-rw7m/GHSA-chqj-j4fh-rw7m.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-chqj-j4fh-rw7m",
-  "modified": "2020-08-31T18:51:06Z",
+  "modified": "2023-09-13T18:51:44Z",
   "published": "2020-08-28T21:25:11Z",
   "aliases": [
     "CVE-2019-16728"
@@ -9,7 +9,10 @@
   "summary": "Cross-Site Scripting in dompurify",
   "details": "Versions of `dompurify` prior to 2.0.3 are vulnerable to Cross-Site Scripting (XSS). The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of `<svg>`/`<math>` elements and `</p>`/`</br>`. An example payload is: `<svg></p><style><a id=\"</style><img src=1 onerror=alert(1)>\">`. This allows attackers to bypass the XSS protection and execute arbitrary JavaScript in a victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 2.0.3 or later. You may also disallow `<svg>` and `<math>` through `dompurify` configurations:\n```DOMPurify.sanitize(input, {\n     FORBID_TAGS: ['svg', 'math']\n });```",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
   ],
   "affected": [
     {
@@ -17,6 +20,11 @@
         "ecosystem": "npm",
         "name": "dompurify"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",
@@ -54,7 +62,7 @@
     "cwe_ids": [
       "CWE-79"
     ],
-    "severity": "CRITICAL",
+    "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2020-08-28T21:24:05Z",
     "nvd_published_at": null