From bcbffa1284c4351708817a9f5853a56e152acebb Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 23 Apr 2024 17:15:06 +0000 Subject: [PATCH] Publish Advisories GHSA-3p68-m5qw-9g9w GHSA-6rm6-mjmh-86jq GHSA-q6v4-xjp2-8ggv GHSA-q6v4-xjp2-8ggv --- .../GHSA-3p68-m5qw-9g9w.json | 35 ++++++++-- .../GHSA-6rm6-mjmh-86jq.json | 35 ++++++++-- .../GHSA-q6v4-xjp2-8ggv.json | 69 +++++++++++++++++++ .../GHSA-q6v4-xjp2-8ggv.json | 42 ----------- 4 files changed, 131 insertions(+), 50 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json (56%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json (65%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json diff --git a/advisories/unreviewed/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json b/advisories/github-reviewed/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json rename to advisories/github-reviewed/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json index 8da4a5679a6..4efaeb9bb68 100644 --- a/advisories/unreviewed/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json +++ b/advisories/github-reviewed/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json @@ -1,23 +1,50 @@ { "schema_version": "1.4.0", "id": "GHSA-3p68-m5qw-9g9w", - "modified": "2022-05-13T01:07:48Z", + "modified": "2024-04-23T17:13:38Z", "published": "2022-05-13T01:07:48Z", "aliases": [ "CVE-2010-4183" ], + "summary": "HTML Purifier cross-site scripting (XSS) vulnerability", "details": "Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "ezyang/htmlpurifier" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4183" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezyang/htmlpurifier/CVE-2010-4183.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ezyang/htmlpurifier" + }, { "type": "WEB", "url": "http://htmlpurifier.org/news/2010/0915-4.2.0-released" @@ -32,8 +59,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:13:38Z", "nvd_published_at": "2010-11-05T17:00:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json b/advisories/github-reviewed/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json similarity index 65% rename from advisories/unreviewed/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json rename to advisories/github-reviewed/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json index 343b29f463a..448f398085d 100644 --- a/advisories/unreviewed/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json +++ b/advisories/github-reviewed/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json @@ -1,23 +1,50 @@ { "schema_version": "1.4.0", "id": "GHSA-6rm6-mjmh-86jq", - "modified": "2022-05-17T05:49:44Z", + "modified": "2024-04-23T17:13:36Z", "published": "2022-05-17T05:49:44Z", "aliases": [ "CVE-2010-2479" ], + "summary": "HTML Purifier Cross-site Scripting (XSS) vulnerability", "details": "Cross-site scripting (XSS) vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "ezyang/htmlpurifier" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2479" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezyang/htmlpurifier/CVE-2010-2479.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ezyang/htmlpurifier" + }, { "type": "WEB", "url": "http://htmlpurifier.org/news/2010/0531-4.1.1-released" @@ -56,8 +83,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:13:36Z", "nvd_published_at": "2010-07-06T17:17:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json b/advisories/github-reviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json new file mode 100644 index 00000000000..a1d1c3cba8a --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q6v4-xjp2-8ggv", + "modified": "2024-04-23T17:14:29Z", + "published": "2022-05-13T01:11:18Z", + "aliases": [ + "CVE-2017-14077" + ], + "summary": "Securimage HTML Injection ", + "details": "HTML Injection in Securimage prior to 3.6.6 allows remote attackers to inject arbitrary HTML into an e-mail message body via the `$_SERVER['HTTP_USER_AGENT']` parameter to `example_form.ajax.php` or `example_form.php`.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "dapphp/securimage" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.6.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14077" + }, + { + "type": "WEB", + "url": "https://github.com/dapphp/securimage/commit/2c7ce3f6fa5ab86fd0ac8e3b4d5d72a21329d8ea" + }, + { + "type": "WEB", + "url": "https://advisory.checkmarx.net/advisory/CX-2017-4223" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dapphp/securimage" + }, + { + "type": "WEB", + "url": "https://www.checkmarx.com/advisories/html-injection-securimage" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:14:29Z", + "nvd_published_at": "2017-11-18T01:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json b/advisories/unreviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json deleted file mode 100644 index 7349933c97f..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-q6v4-xjp2-8ggv", - "modified": "2022-05-13T01:11:18Z", - "published": "2022-05-13T01:11:18Z", - "aliases": [ - "CVE-2017-14077" - ], - "details": "HTML Injection in Securimage 3.6.4 and earlier allows remote attackers to inject arbitrary HTML into an e-mail message body via the $_SERVER['HTTP_USER_AGENT'] parameter to example_form.ajax.php or example_form.php.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14077" - }, - { - "type": "WEB", - "url": "https://advisory.checkmarx.net/advisory/CX-2017-4223" - }, - { - "type": "WEB", - "url": "https://www.checkmarx.com/advisories/html-injection-securimage" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-11-18T01:29:00Z" - } -} \ No newline at end of file