From b542c79717e4b7a1de8699f8220cb416fdbe617f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 23 Apr 2024 17:27:32 +0000 Subject: [PATCH] Publish Advisories GHSA-3p9v-xp6w-wcmc GHSA-489x-ccjw-q7c4 GHSA-62g2-8p9f-ghjp GHSA-vg4f-8v9q-5c3x --- .../GHSA-3p9v-xp6w-wcmc.json | 31 ++++++++++-- .../GHSA-489x-ccjw-q7c4.json | 50 +++++++++++++++++-- .../GHSA-62g2-8p9f-ghjp.json | 23 +++++++-- .../GHSA-vg4f-8v9q-5c3x.json | 33 ++++++++++-- 4 files changed, 119 insertions(+), 18 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-3p9v-xp6w-wcmc/GHSA-3p9v-xp6w-wcmc.json (59%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-489x-ccjw-q7c4/GHSA-489x-ccjw-q7c4.json (52%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-62g2-8p9f-ghjp/GHSA-62g2-8p9f-ghjp.json (52%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-vg4f-8v9q-5c3x/GHSA-vg4f-8v9q-5c3x.json (53%) diff --git a/advisories/unreviewed/2022/05/GHSA-3p9v-xp6w-wcmc/GHSA-3p9v-xp6w-wcmc.json b/advisories/github-reviewed/2022/05/GHSA-3p9v-xp6w-wcmc/GHSA-3p9v-xp6w-wcmc.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-3p9v-xp6w-wcmc/GHSA-3p9v-xp6w-wcmc.json rename to advisories/github-reviewed/2022/05/GHSA-3p9v-xp6w-wcmc/GHSA-3p9v-xp6w-wcmc.json index b46bd940b1a..fcbc83315f1 100644 --- a/advisories/unreviewed/2022/05/GHSA-3p9v-xp6w-wcmc/GHSA-3p9v-xp6w-wcmc.json +++ b/advisories/github-reviewed/2022/05/GHSA-3p9v-xp6w-wcmc/GHSA-3p9v-xp6w-wcmc.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-3p9v-xp6w-wcmc", - "modified": "2022-05-14T01:57:27Z", + "modified": "2024-04-23T17:26:49Z", "published": "2022-05-14T01:57:27Z", "aliases": [ "CVE-2018-17102" ], + "summary": "QuickAppsCMS Cross-Site Request Forgery (CSRF) ", "details": "An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2. A CSRF vulnerability can change the administrator password via the user/me URI.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "quickapps/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.0.0-beta2" + } + ] + } + ] + } ], "references": [ { @@ -28,6 +47,10 @@ { "type": "WEB", "url": "https://github.com/quickapps/cms/issues/199" + }, + { + "type": "PACKAGE", + "url": "https://github.com/quickapps/cms" } ], "database_specific": { @@ -35,8 +58,8 @@ "CWE-352" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:26:49Z", "nvd_published_at": "2018-09-16T21:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-489x-ccjw-q7c4/GHSA-489x-ccjw-q7c4.json b/advisories/github-reviewed/2022/05/GHSA-489x-ccjw-q7c4/GHSA-489x-ccjw-q7c4.json similarity index 52% rename from advisories/unreviewed/2022/05/GHSA-489x-ccjw-q7c4/GHSA-489x-ccjw-q7c4.json rename to advisories/github-reviewed/2022/05/GHSA-489x-ccjw-q7c4/GHSA-489x-ccjw-q7c4.json index 6dd3ccd8fdd..c9132ee928b 100644 --- a/advisories/unreviewed/2022/05/GHSA-489x-ccjw-q7c4/GHSA-489x-ccjw-q7c4.json +++ b/advisories/github-reviewed/2022/05/GHSA-489x-ccjw-q7c4/GHSA-489x-ccjw-q7c4.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-489x-ccjw-q7c4", - "modified": "2022-05-13T01:49:53Z", + "modified": "2024-04-23T17:25:44Z", "published": "2022-05-13T01:49:53Z", "aliases": [ "CVE-2018-14020" ], + "summary": "Paymorrow Improper Input Validation vulnerability", "details": "An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop. An attacker can bypass delivery-address change detection if the payment module doesn't use eShop's checkout procedure properly. To do so, the attacker must change the delivery address to one that is not verified by the Paymorrow module.", "severity": [ { @@ -14,7 +15,44 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "oxid-esales/paymorrow-module" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0" + }, + { + "fixed": "1.0.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "oxid-esales/paymorrow-module" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.1" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +63,10 @@ "type": "WEB", "url": "https://bugs.oxid-esales.com/view.php?id=6801" }, + { + "type": "PACKAGE", + "url": "https://github.com/OXID-eSales/paymorrow-module" + }, { "type": "WEB", "url": "https://oxidforge.org/en/security-bulletin-2018-003.html" @@ -35,8 +77,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:25:44Z", "nvd_published_at": "2018-08-20T22:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-62g2-8p9f-ghjp/GHSA-62g2-8p9f-ghjp.json b/advisories/github-reviewed/2022/05/GHSA-62g2-8p9f-ghjp/GHSA-62g2-8p9f-ghjp.json similarity index 52% rename from advisories/unreviewed/2022/05/GHSA-62g2-8p9f-ghjp/GHSA-62g2-8p9f-ghjp.json rename to advisories/github-reviewed/2022/05/GHSA-62g2-8p9f-ghjp/GHSA-62g2-8p9f-ghjp.json index 102139bff9f..56460902c8a 100644 --- a/advisories/unreviewed/2022/05/GHSA-62g2-8p9f-ghjp/GHSA-62g2-8p9f-ghjp.json +++ b/advisories/github-reviewed/2022/05/GHSA-62g2-8p9f-ghjp/GHSA-62g2-8p9f-ghjp.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-62g2-8p9f-ghjp", - "modified": "2022-05-14T03:29:59Z", + "modified": "2024-04-23T17:26:55Z", "published": "2022-05-14T03:29:59Z", "aliases": [ "CVE-2018-9108" ], - "details": "CSRF in /admin/user/manage/add in QuickAppsCMS 2.0.0-beta2 allows an unauthorized remote attacker to create an account with admin privileges.", + "summary": "QuickAppsCMS Cross-Site Request Forgery (CSRF) ", + "details": "CSRF in `/admin/user/manage/add` in QuickAppsCMS 2.0.0-beta2 allows an unauthorized remote attacker to create an account with admin privileges.", "severity": [ { "type": "CVSS_V3", @@ -14,7 +15,15 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "quickapps/cms" + }, + "versions": [ + "2.0.0-beta2" + ] + } ], "references": [ { @@ -24,6 +33,10 @@ { "type": "WEB", "url": "https://github.com/quickapps/cms/issues/187" + }, + { + "type": "PACKAGE", + "url": "https://github.com/quickapps/cms" } ], "database_specific": { @@ -31,8 +44,8 @@ "CWE-352" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:26:55Z", "nvd_published_at": "2018-03-28T04:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-vg4f-8v9q-5c3x/GHSA-vg4f-8v9q-5c3x.json b/advisories/github-reviewed/2022/05/GHSA-vg4f-8v9q-5c3x/GHSA-vg4f-8v9q-5c3x.json similarity index 53% rename from advisories/unreviewed/2022/05/GHSA-vg4f-8v9q-5c3x/GHSA-vg4f-8v9q-5c3x.json rename to advisories/github-reviewed/2022/05/GHSA-vg4f-8v9q-5c3x/GHSA-vg4f-8v9q-5c3x.json index 6de45556469..901ea63ab3a 100644 --- a/advisories/unreviewed/2022/05/GHSA-vg4f-8v9q-5c3x/GHSA-vg4f-8v9q-5c3x.json +++ b/advisories/github-reviewed/2022/05/GHSA-vg4f-8v9q-5c3x/GHSA-vg4f-8v9q-5c3x.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-vg4f-8v9q-5c3x", - "modified": "2022-05-13T01:48:34Z", + "modified": "2024-04-23T17:25:35Z", "published": "2022-05-13T01:48:33Z", "aliases": [ "CVE-2018-1000165" ], - "details": "LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later.", + "summary": "LightSAML Incorrect Access Control vulnerability", + "details": "LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in `src/LightSaml/Model/XmlDSig/` that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later.", "severity": [ { "type": "CVSS_V3", @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "lightsaml/lightsaml" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.3.5" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/lightSAML/lightSAML/commit/47cef07bb09779df15620799f3763d1b8d32307a" }, + { + "type": "PACKAGE", + "url": "https://github.com/lightSAML/lightSAML" + }, { "type": "WEB", "url": "https://github.com/lightSAML/lightSAML/releases/tag/1.3.5" @@ -35,8 +58,8 @@ "CWE-732" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:25:35Z", "nvd_published_at": "2018-04-18T19:29:00Z" } } \ No newline at end of file