diff --git a/advisories/github-reviewed/2020/01/GHSA-8w65-xjc5-9w79/GHSA-8w65-xjc5-9w79.json b/advisories/github-reviewed/2020/01/GHSA-8w65-xjc5-9w79/GHSA-8w65-xjc5-9w79.json index a8aaac6dbf3..855d5dfedd6 100644 --- a/advisories/github-reviewed/2020/01/GHSA-8w65-xjc5-9w79/GHSA-8w65-xjc5-9w79.json +++ b/advisories/github-reviewed/2020/01/GHSA-8w65-xjc5-9w79/GHSA-8w65-xjc5-9w79.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8w65-xjc5-9w79", - "modified": "2020-08-31T18:59:55Z", + "modified": "2023-09-11T18:10:34Z", "published": "2020-01-30T21:00:21Z", "aliases": [ "CVE-2019-15607" @@ -9,7 +9,10 @@ "summary": "Cross-Site Scripting in node-red", "details": "Versions of `node-red` prior to 0.20.8are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the `name` field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 0.18.6 or later.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ { @@ -17,6 +20,11 @@ "ecosystem": "npm", "name": "node-red" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", diff --git a/advisories/github-reviewed/2023/09/GHSA-4cpv-669c-r79x/GHSA-4cpv-669c-r79x.json b/advisories/github-reviewed/2023/09/GHSA-4cpv-669c-r79x/GHSA-4cpv-669c-r79x.json index e751cfd0b10..9b36986c406 100644 --- a/advisories/github-reviewed/2023/09/GHSA-4cpv-669c-r79x/GHSA-4cpv-669c-r79x.json +++ b/advisories/github-reviewed/2023/09/GHSA-4cpv-669c-r79x/GHSA-4cpv-669c-r79x.json @@ -49,6 +49,10 @@ "type": "WEB", "url": "https://github.com/symfony/ux-autocomplete/commit/fabcb2eee14b9e84a45b276711853a560b5d770c" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-autocomplete/CVE-2023-41336.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/symfony/ux-autocomplete" diff --git a/advisories/github-reviewed/2023/09/GHSA-9832-mgg4-3gr6/GHSA-9832-mgg4-3gr6.json b/advisories/github-reviewed/2023/09/GHSA-9832-mgg4-3gr6/GHSA-9832-mgg4-3gr6.json index 77ba193a2f0..5a17eca2702 100644 --- a/advisories/github-reviewed/2023/09/GHSA-9832-mgg4-3gr6/GHSA-9832-mgg4-3gr6.json +++ b/advisories/github-reviewed/2023/09/GHSA-9832-mgg4-3gr6/GHSA-9832-mgg4-3gr6.json @@ -56,6 +56,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-281", "CWE-918" ], "severity": "MODERATE",