diff --git a/advisories/unreviewed/2022/05/GHSA-38g6-x6jv-jwff/GHSA-38g6-x6jv-jwff.json b/advisories/github-reviewed/2022/05/GHSA-38g6-x6jv-jwff/GHSA-38g6-x6jv-jwff.json similarity index 54% rename from advisories/unreviewed/2022/05/GHSA-38g6-x6jv-jwff/GHSA-38g6-x6jv-jwff.json rename to advisories/github-reviewed/2022/05/GHSA-38g6-x6jv-jwff/GHSA-38g6-x6jv-jwff.json index 9daa26edbb9..a01d4e83efa 100644 --- a/advisories/unreviewed/2022/05/GHSA-38g6-x6jv-jwff/GHSA-38g6-x6jv-jwff.json +++ b/advisories/github-reviewed/2022/05/GHSA-38g6-x6jv-jwff/GHSA-38g6-x6jv-jwff.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-38g6-x6jv-jwff", - "modified": "2022-05-24T22:01:29Z", + "modified": "2024-04-22T22:50:56Z", "published": "2022-05-24T22:01:29Z", "aliases": [ "CVE-2021-29002" ], - "details": "A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the \"form.widgets.site_title\" parameter.", + "summary": "Plone XSS Vulnerability", + "details": "A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the `form.widgets.site_title` parameter.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "plone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.2.3" + } + ] + } + ] + } ], "references": [ { @@ -32,8 +51,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:50:56Z", "nvd_published_at": "2021-03-24T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-84jm-cpc5-c7g7/GHSA-84jm-cpc5-c7g7.json b/advisories/github-reviewed/2022/05/GHSA-84jm-cpc5-c7g7/GHSA-84jm-cpc5-c7g7.json new file mode 100644 index 00000000000..b9a5b96bf7a --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-84jm-cpc5-c7g7/GHSA-84jm-cpc5-c7g7.json @@ -0,0 +1,90 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-84jm-cpc5-c7g7", + "modified": "2024-04-22T22:51:31Z", + "published": "2022-05-17T03:00:45Z", + "aliases": [ + "CVE-2016-7147" + ], + "summary": "Plone XSS in Zope ZMI", + "details": "Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the `obj_ids:tokens` parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7140.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "plone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0" + }, + { + "fixed": "4.3.12" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.3.11" + } + }, + { + "package": { + "ecosystem": "PyPI", + "name": "plone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0" + }, + { + "fixed": "5.0.7" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 5.0.6" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7147" + }, + { + "type": "WEB", + "url": "https://plone.org/security/hotfix/20170117" + }, + { + "type": "WEB", + "url": "https://plone.org/security/hotfix/20170117/non-persistent-xss-in-zope2" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20170214002551/http://www.securityfocus.com/bid/96117" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:51:31Z", + "nvd_published_at": "2017-02-04T05:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-hprr-4vfq-fcxw/GHSA-hprr-4vfq-fcxw.json b/advisories/github-reviewed/2022/05/GHSA-hprr-4vfq-fcxw/GHSA-hprr-4vfq-fcxw.json similarity index 63% rename from advisories/unreviewed/2022/05/GHSA-hprr-4vfq-fcxw/GHSA-hprr-4vfq-fcxw.json rename to advisories/github-reviewed/2022/05/GHSA-hprr-4vfq-fcxw/GHSA-hprr-4vfq-fcxw.json index 3499e19aa71..f813327e3fc 100644 --- a/advisories/unreviewed/2022/05/GHSA-hprr-4vfq-fcxw/GHSA-hprr-4vfq-fcxw.json +++ b/advisories/github-reviewed/2022/05/GHSA-hprr-4vfq-fcxw/GHSA-hprr-4vfq-fcxw.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-hprr-4vfq-fcxw", - "modified": "2022-05-24T19:02:50Z", + "modified": "2024-04-22T22:51:01Z", "published": "2022-05-24T19:02:50Z", "aliases": [ "CVE-2021-3313" ], + "summary": "Plone XSS in User Fullname Property and File Upload", "details": "Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "plone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 5.2.4" + } + } ], "references": [ { @@ -24,7 +43,11 @@ }, { "type": "WEB", - "url": "https://plone.org/security/hotfix/20210518" + "url": "https://plone.org/security/hotfix/20210518/stored-xss-from-file-upload-svg-html" + }, + { + "type": "WEB", + "url": "https://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname" }, { "type": "WEB", @@ -40,8 +63,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:51:01Z", "nvd_published_at": "2021-05-20T16:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-qfhw-fv3g-v836/GHSA-qfhw-fv3g-v836.json b/advisories/github-reviewed/2022/05/GHSA-qfhw-fv3g-v836/GHSA-qfhw-fv3g-v836.json similarity index 63% rename from advisories/unreviewed/2022/05/GHSA-qfhw-fv3g-v836/GHSA-qfhw-fv3g-v836.json rename to advisories/github-reviewed/2022/05/GHSA-qfhw-fv3g-v836/GHSA-qfhw-fv3g-v836.json index 8c1e39c4f5a..229683ec941 100644 --- a/advisories/unreviewed/2022/05/GHSA-qfhw-fv3g-v836/GHSA-qfhw-fv3g-v836.json +++ b/advisories/github-reviewed/2022/05/GHSA-qfhw-fv3g-v836/GHSA-qfhw-fv3g-v836.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-qfhw-fv3g-v836", - "modified": "2022-05-24T19:06:41Z", + "modified": "2024-04-22T22:51:04Z", "published": "2022-05-24T19:06:41Z", "aliases": [ "CVE-2021-35959" ], + "summary": "Plone has stored XSS in folder contents", "details": "In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "plone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0" + }, + { + "last_affected": "5.2.4" + } + ] + } + ] + } ], "references": [ { @@ -32,8 +51,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:51:04Z", "nvd_published_at": "2021-06-30T01:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-v83x-78q3-gr2j/GHSA-v83x-78q3-gr2j.json b/advisories/github-reviewed/2022/05/GHSA-v83x-78q3-gr2j/GHSA-v83x-78q3-gr2j.json similarity index 51% rename from advisories/unreviewed/2022/05/GHSA-v83x-78q3-gr2j/GHSA-v83x-78q3-gr2j.json rename to advisories/github-reviewed/2022/05/GHSA-v83x-78q3-gr2j/GHSA-v83x-78q3-gr2j.json index 0b589da0107..b99137b6531 100644 --- a/advisories/unreviewed/2022/05/GHSA-v83x-78q3-gr2j/GHSA-v83x-78q3-gr2j.json +++ b/advisories/github-reviewed/2022/05/GHSA-v83x-78q3-gr2j/GHSA-v83x-78q3-gr2j.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-v83x-78q3-gr2j", - "modified": "2022-05-24T19:14:08Z", + "modified": "2024-04-22T22:50:22Z", "published": "2022-05-24T19:14:08Z", "aliases": [ "CVE-2021-40347" ], - "details": "An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.", + "summary": "GNU Mailman Postorius Access Control Issues", + "details": "An issue was discovered in `views/list.py` in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "postorius" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.3.5" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +44,10 @@ "type": "WEB", "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993746" }, + { + "type": "PACKAGE", + "url": "https://gitlab.com/mailman/postorius" + }, { "type": "WEB", "url": "https://gitlab.com/mailman/postorius/-/commit/3d880c56b58bc26b32eac0799407d74b64b7474b" @@ -45,11 +71,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:50:22Z", "nvd_published_at": "2021-09-10T19:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-x9rq-fjp5-qgm9/GHSA-x9rq-fjp5-qgm9.json b/advisories/github-reviewed/2022/05/GHSA-x9rq-fjp5-qgm9/GHSA-x9rq-fjp5-qgm9.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-x9rq-fjp5-qgm9/GHSA-x9rq-fjp5-qgm9.json rename to advisories/github-reviewed/2022/05/GHSA-x9rq-fjp5-qgm9/GHSA-x9rq-fjp5-qgm9.json index 0db589aaaf7..20ccb6b9643 100644 --- a/advisories/unreviewed/2022/05/GHSA-x9rq-fjp5-qgm9/GHSA-x9rq-fjp5-qgm9.json +++ b/advisories/github-reviewed/2022/05/GHSA-x9rq-fjp5-qgm9/GHSA-x9rq-fjp5-qgm9.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-x9rq-fjp5-qgm9", - "modified": "2022-05-24T19:02:06Z", + "modified": "2024-04-22T22:50:31Z", "published": "2022-05-24T19:02:06Z", "aliases": [ "CVE-2021-32560" ], - "details": "The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.", + "summary": "OctoPrint Incorrect Access Control", + "details": "The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not `*.log` files.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "octoprint" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.6.0" + } + ] + } + ] + } ], "references": [ { @@ -26,10 +48,6 @@ "type": "WEB", "url": "https://octoprint.org/blog/2021/04/27/new-release-1.6.0" }, - { - "type": "WEB", - "url": "https://www.brzozowski.io" - }, { "type": "WEB", "url": "https://www.brzozowski.io/web-applications/2021/05/11/the-insecure-story-of-octoprint.html" @@ -37,11 +55,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:50:31Z", "nvd_published_at": "2021-05-11T14:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-84jm-cpc5-c7g7/GHSA-84jm-cpc5-c7g7.json b/advisories/unreviewed/2022/05/GHSA-84jm-cpc5-c7g7/GHSA-84jm-cpc5-c7g7.json deleted file mode 100644 index 5cd5f7e067a..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-84jm-cpc5-c7g7/GHSA-84jm-cpc5-c7g7.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-84jm-cpc5-c7g7", - "modified": "2022-05-17T03:00:45Z", - "published": "2022-05-17T03:00:45Z", - "aliases": [ - "CVE-2016-7147" - ], - "details": "Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the obj_ids:tokens parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7140.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7147" - }, - { - "type": "WEB", - "url": "https://plone.org/security/hotfix/20170117" - }, - { - "type": "WEB", - "url": "https://plone.org/security/hotfix/20170117/non-persistent-xss-in-zope2" - }, - { - "type": "WEB", - "url": "https://www.curesec.com/blog/article/blog/Plone-XSS-186.html" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/96117" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-02-04T05:59:00Z" - } -} \ No newline at end of file