diff --git a/advisories/unreviewed/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json b/advisories/github-reviewed/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json rename to advisories/github-reviewed/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json index 8da4a5679a6..4efaeb9bb68 100644 --- a/advisories/unreviewed/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json +++ b/advisories/github-reviewed/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json @@ -1,23 +1,50 @@ { "schema_version": "1.4.0", "id": "GHSA-3p68-m5qw-9g9w", - "modified": "2022-05-13T01:07:48Z", + "modified": "2024-04-23T17:13:38Z", "published": "2022-05-13T01:07:48Z", "aliases": [ "CVE-2010-4183" ], + "summary": "HTML Purifier cross-site scripting (XSS) vulnerability", "details": "Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "ezyang/htmlpurifier" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4183" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezyang/htmlpurifier/CVE-2010-4183.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ezyang/htmlpurifier" + }, { "type": "WEB", "url": "http://htmlpurifier.org/news/2010/0915-4.2.0-released" @@ -32,8 +59,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:13:38Z", "nvd_published_at": "2010-11-05T17:00:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json b/advisories/github-reviewed/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json similarity index 65% rename from advisories/unreviewed/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json rename to advisories/github-reviewed/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json index 343b29f463a..448f398085d 100644 --- a/advisories/unreviewed/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json +++ b/advisories/github-reviewed/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json @@ -1,23 +1,50 @@ { "schema_version": "1.4.0", "id": "GHSA-6rm6-mjmh-86jq", - "modified": "2022-05-17T05:49:44Z", + "modified": "2024-04-23T17:13:36Z", "published": "2022-05-17T05:49:44Z", "aliases": [ "CVE-2010-2479" ], + "summary": "HTML Purifier Cross-site Scripting (XSS) vulnerability", "details": "Cross-site scripting (XSS) vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "ezyang/htmlpurifier" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2479" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezyang/htmlpurifier/CVE-2010-2479.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ezyang/htmlpurifier" + }, { "type": "WEB", "url": "http://htmlpurifier.org/news/2010/0531-4.1.1-released" @@ -56,8 +83,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:13:36Z", "nvd_published_at": "2010-07-06T17:17:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json b/advisories/github-reviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json new file mode 100644 index 00000000000..a1d1c3cba8a --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q6v4-xjp2-8ggv", + "modified": "2024-04-23T17:14:29Z", + "published": "2022-05-13T01:11:18Z", + "aliases": [ + "CVE-2017-14077" + ], + "summary": "Securimage HTML Injection ", + "details": "HTML Injection in Securimage prior to 3.6.6 allows remote attackers to inject arbitrary HTML into an e-mail message body via the `$_SERVER['HTTP_USER_AGENT']` parameter to `example_form.ajax.php` or `example_form.php`.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "dapphp/securimage" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.6.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14077" + }, + { + "type": "WEB", + "url": "https://github.com/dapphp/securimage/commit/2c7ce3f6fa5ab86fd0ac8e3b4d5d72a21329d8ea" + }, + { + "type": "WEB", + "url": "https://advisory.checkmarx.net/advisory/CX-2017-4223" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dapphp/securimage" + }, + { + "type": "WEB", + "url": "https://www.checkmarx.com/advisories/html-injection-securimage" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:14:29Z", + "nvd_published_at": "2017-11-18T01:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json b/advisories/unreviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json deleted file mode 100644 index 7349933c97f..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-q6v4-xjp2-8ggv", - "modified": "2022-05-13T01:11:18Z", - "published": "2022-05-13T01:11:18Z", - "aliases": [ - "CVE-2017-14077" - ], - "details": "HTML Injection in Securimage 3.6.4 and earlier allows remote attackers to inject arbitrary HTML into an e-mail message body via the $_SERVER['HTTP_USER_AGENT'] parameter to example_form.ajax.php or example_form.php.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14077" - }, - { - "type": "WEB", - "url": "https://advisory.checkmarx.net/advisory/CX-2017-4223" - }, - { - "type": "WEB", - "url": "https://www.checkmarx.com/advisories/html-injection-securimage" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-11-18T01:29:00Z" - } -} \ No newline at end of file