From b088d35884fcb5b020cd6bd82205f177f63ff978 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 13 Sep 2023 18:52:08 +0000
Subject: [PATCH] Publish Advisories

GHSA-2j2j-8rrv-264g
GHSA-chqj-j4fh-rw7m
---
 .../GHSA-2j2j-8rrv-264g/GHSA-2j2j-8rrv-264g.json   | 14 +++++++++++---
 .../GHSA-chqj-j4fh-rw7m/GHSA-chqj-j4fh-rw7m.json   | 14 +++++++++++---
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/advisories/github-reviewed/2018/09/GHSA-2j2j-8rrv-264g/GHSA-2j2j-8rrv-264g.json b/advisories/github-reviewed/2018/09/GHSA-2j2j-8rrv-264g/GHSA-2j2j-8rrv-264g.json
index 65bf512f119..0c94db2d2f5 100644
--- a/advisories/github-reviewed/2018/09/GHSA-2j2j-8rrv-264g/GHSA-2j2j-8rrv-264g.json
+++ b/advisories/github-reviewed/2018/09/GHSA-2j2j-8rrv-264g/GHSA-2j2j-8rrv-264g.json
@@ -1,15 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2j2j-8rrv-264g",
-  "modified": "2020-08-31T18:33:49Z",
+  "modified": "2023-09-13T18:50:53Z",
   "published": "2018-09-11T18:58:40Z",
   "aliases": [
     "CVE-2018-16459"
   ],
   "summary": "Cross-Site Scripting in exceljs",
-  "details": "Versions of `exceljs` before 1.6.0 are vulnerable to cross-site scripting. \n\nThis vulnerability is due to `exceljs` does not  validate data from parsed XLSX file and allows to embed HTML tags, like `<script>`, directly in the sheet cells. Because of this it's possible to inject malicious JavaScript code and execute it when data from the sheet were displayed in the browser.\n\n\n\n\n## Recommendation\n\nUpdate to version 1.6.0 or later.",
+  "details": "Versions of `exceljs` before 1.6.0 are vulnerable to cross-site scripting. \n\nThis vulnerability is due to `exceljs` not validating data from parsed XLSX file and embedding HTML tags, like `<script>` directly into the sheet cells. Because of this it's possible to inject malicious JavaScript code and execute it when data from the sheet is displayed in the browser.\n\n\n\n\n## Recommendation\n\nUpdate to version 1.6.0 or later.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
   ],
   "affected": [
     {
@@ -17,6 +20,11 @@
         "ecosystem": "npm",
         "name": "exceljs"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",
diff --git a/advisories/github-reviewed/2020/08/GHSA-chqj-j4fh-rw7m/GHSA-chqj-j4fh-rw7m.json b/advisories/github-reviewed/2020/08/GHSA-chqj-j4fh-rw7m/GHSA-chqj-j4fh-rw7m.json
index bf24ce91560..313d4b8d6c1 100644
--- a/advisories/github-reviewed/2020/08/GHSA-chqj-j4fh-rw7m/GHSA-chqj-j4fh-rw7m.json
+++ b/advisories/github-reviewed/2020/08/GHSA-chqj-j4fh-rw7m/GHSA-chqj-j4fh-rw7m.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-chqj-j4fh-rw7m",
-  "modified": "2020-08-31T18:51:06Z",
+  "modified": "2023-09-13T18:51:44Z",
   "published": "2020-08-28T21:25:11Z",
   "aliases": [
     "CVE-2019-16728"
@@ -9,7 +9,10 @@
   "summary": "Cross-Site Scripting in dompurify",
   "details": "Versions of `dompurify` prior to 2.0.3 are vulnerable to Cross-Site Scripting (XSS). The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of `<svg>`/`<math>` elements and `</p>`/`</br>`. An example payload is: `<svg></p><style><a id=\"</style><img src=1 onerror=alert(1)>\">`. This allows attackers to bypass the XSS protection and execute arbitrary JavaScript in a victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 2.0.3 or later. You may also disallow `<svg>` and `<math>` through `dompurify` configurations:\n```DOMPurify.sanitize(input, {\n     FORBID_TAGS: ['svg', 'math']\n });```",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
   ],
   "affected": [
     {
@@ -17,6 +20,11 @@
         "ecosystem": "npm",
         "name": "dompurify"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",
@@ -54,7 +62,7 @@
     "cwe_ids": [
       "CWE-79"
     ],
-    "severity": "CRITICAL",
+    "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2020-08-28T21:24:05Z",
     "nvd_published_at": null