diff --git a/advisories/github-reviewed/2024/04/GHSA-mx3p-fhpw-x6rv/GHSA-mx3p-fhpw-x6rv.json b/advisories/github-reviewed/2024/04/GHSA-mx3p-fhpw-x6rv/GHSA-mx3p-fhpw-x6rv.json index 5fe1aad6f8a..d18fd13470f 100644 --- a/advisories/github-reviewed/2024/04/GHSA-mx3p-fhpw-x6rv/GHSA-mx3p-fhpw-x6rv.json +++ b/advisories/github-reviewed/2024/04/GHSA-mx3p-fhpw-x6rv/GHSA-mx3p-fhpw-x6rv.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-mx3p-fhpw-x6rv", - "modified": "2024-05-02T03:30:32Z", + "modified": "2024-06-11T20:59:17Z", "published": "2024-04-19T18:31:11Z", "aliases": [ "CVE-2024-22640" ], "summary": "TCPDF vulnerable to Regular Expression Denial of Service", - "details": "TCPDF version <=6.7.4 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.", + "details": "TCPDF version <= 6.7.4 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.", "severity": [ ], @@ -25,11 +25,14 @@ "introduced": "0" }, { - "last_affected": "6.7.4" + "fixed": "6.7.5" } ] } - ] + ], + "database_specific": { + "last_known_affected_version_range": "<= 6.7.4" + } } ], "references": [ @@ -37,6 +40,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22640" }, + { + "type": "WEB", + "url": "https://github.com/tecnickcom/TCPDF/commit/05f3a28f4a7905019469e040cf77e53d6aa7f679" + }, { "type": "PACKAGE", "url": "https://github.com/tecnickcom/TCPDF" diff --git a/advisories/github-reviewed/2024/06/GHSA-v4g2-cm5v-cxv7/GHSA-v4g2-cm5v-cxv7.json b/advisories/github-reviewed/2024/06/GHSA-v4g2-cm5v-cxv7/GHSA-v4g2-cm5v-cxv7.json index bed7c463fda..b8507629e32 100644 --- a/advisories/github-reviewed/2024/06/GHSA-v4g2-cm5v-cxv7/GHSA-v4g2-cm5v-cxv7.json +++ b/advisories/github-reviewed/2024/06/GHSA-v4g2-cm5v-cxv7/GHSA-v4g2-cm5v-cxv7.json @@ -1,10 +1,10 @@ { "schema_version": "1.4.0", "id": "GHSA-v4g2-cm5v-cxv7", - "modified": "2024-06-05T13:30:55Z", + "modified": "2024-06-11T20:58:10Z", "published": "2024-06-05T13:30:55Z", "aliases": [ - + "CVE-2024-37296" ], "summary": "Digital products download without proper payment status check", "details": "### Impact\nDigital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed.\n\n### Patches\nNew versions for the Aimeos HTML client 2020-2024 are available\n", @@ -119,6 +119,30 @@ "type": "WEB", "url": "https://github.com/aimeos/ai-client-html/security/advisories/GHSA-v4g2-cm5v-cxv7" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37296" + }, + { + "type": "WEB", + "url": "https://github.com/aimeos/ai-client-html/commit/12d8aad1a373bf9d350872501adec3e222164f83" + }, + { + "type": "WEB", + "url": "https://github.com/aimeos/ai-client-html/commit/5a7249769142b3ce70959ab1fb70c7e7c251e214" + }, + { + "type": "WEB", + "url": "https://github.com/aimeos/ai-client-html/commit/6460ffe8f4929d864164aa96c5b49eca5326d975" + }, + { + "type": "WEB", + "url": "https://github.com/aimeos/ai-client-html/commit/7f01d2f4fbc67f5231fd84adeb835d28252b8409" + }, + { + "type": "WEB", + "url": "https://github.com/aimeos/ai-client-html/commit/fc611ff9a57e421d0ad9d99346b561cea515c5f0" + }, { "type": "PACKAGE", "url": "https://github.com/aimeos/ai-client-html" @@ -131,6 +155,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-06-05T13:30:55Z", - "nvd_published_at": null + "nvd_published_at": "2024-06-11T15:16:09Z" } } \ No newline at end of file