diff --git a/advisories/unreviewed/2022/05/GHSA-48q3-m4hf-56c9/GHSA-48q3-m4hf-56c9.json b/advisories/github-reviewed/2022/05/GHSA-48q3-m4hf-56c9/GHSA-48q3-m4hf-56c9.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-48q3-m4hf-56c9/GHSA-48q3-m4hf-56c9.json rename to advisories/github-reviewed/2022/05/GHSA-48q3-m4hf-56c9/GHSA-48q3-m4hf-56c9.json index feb73797141..009d1315242 100644 --- a/advisories/unreviewed/2022/05/GHSA-48q3-m4hf-56c9/GHSA-48q3-m4hf-56c9.json +++ b/advisories/github-reviewed/2022/05/GHSA-48q3-m4hf-56c9/GHSA-48q3-m4hf-56c9.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-48q3-m4hf-56c9", - "modified": "2025-04-20T03:35:57Z", + "modified": "2025-04-22T17:33:02Z", "published": "2022-05-17T02:49:21Z", "aliases": [ "CVE-2015-7562" ], + "summary": "TeamPass vulnerable to Cross-site Scripting", "details": "Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) label value of an item or (2) name of a role.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "nilsteampassnet/teampass" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.25" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -23,6 +44,10 @@ "type": "WEB", "url": "https://github.com/nilsteampassnet/TeamPass/pull/1140" }, + { + "type": "PACKAGE", + "url": "https://github.com/nilsteampassnet/TeamPass" + }, { "type": "WEB", "url": "https://www.exploit-db.com/exploits/39559" @@ -33,8 +58,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T17:33:02Z", "nvd_published_at": "2017-04-12T22:59:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-49wf-927p-jpvj/GHSA-49wf-927p-jpvj.json b/advisories/github-reviewed/2022/05/GHSA-49wf-927p-jpvj/GHSA-49wf-927p-jpvj.json new file mode 100644 index 00000000000..1bb084f4132 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-49wf-927p-jpvj/GHSA-49wf-927p-jpvj.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-49wf-927p-jpvj", + "modified": "2025-04-22T17:32:27Z", + "published": "2022-05-17T02:50:39Z", + "aliases": [ + "CVE-2015-1611" + ], + "summary": "OpenFlow plugin for OpenDaylight allows spoofing the SDN topology", + "details": "OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to \"fake LLDP injection.\"", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.opendaylight.openflowplugin:openflowplugin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.6-Helium-SR3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1611" + }, + { + "type": "WEB", + "url": "https://git.opendaylight.org/gerrit/#/c/16193" + }, + { + "type": "WEB", + "url": "https://git.opendaylight.org/gerrit/#/c/16208" + }, + { + "type": "PACKAGE", + "url": "https://github.com/opendaylight/openflowplugin" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20150510044305/https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1611_CVE-2015-1612_openflowplugin:_topology_spoofing_via_LLDP" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20150701104709/https://www.internetsociety.org/sites/default/files/10_4_2.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T17:32:26Z", + "nvd_published_at": "2017-04-04T17:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-f2x4-547g-rp95/GHSA-f2x4-547g-rp95.json b/advisories/github-reviewed/2022/05/GHSA-f2x4-547g-rp95/GHSA-f2x4-547g-rp95.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-f2x4-547g-rp95/GHSA-f2x4-547g-rp95.json rename to advisories/github-reviewed/2022/05/GHSA-f2x4-547g-rp95/GHSA-f2x4-547g-rp95.json index 0c7240cb0f5..a6e451eadfd 100644 --- a/advisories/unreviewed/2022/05/GHSA-f2x4-547g-rp95/GHSA-f2x4-547g-rp95.json +++ b/advisories/github-reviewed/2022/05/GHSA-f2x4-547g-rp95/GHSA-f2x4-547g-rp95.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-f2x4-547g-rp95", - "modified": "2025-04-20T03:35:26Z", + "modified": "2025-04-22T17:32:35Z", "published": "2022-05-17T02:50:39Z", "aliases": [ "CVE-2015-1612" ], + "summary": "OpenFlow plugin for OpenDaylight LLDP Relay", "details": "OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to the reuse of LLDP packets, aka \"LLDP Relay.\"", "severity": [ { @@ -13,16 +14,32 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.opendaylight.openflowplugin:openflowplugin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.6-Helium-SR3" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1612" }, - { - "type": "WEB", - "url": "https://cloudrouter.org/security" - }, { "type": "WEB", "url": "https://git.opendaylight.org/gerrit/#/c/16193" @@ -32,16 +49,16 @@ "url": "https://git.opendaylight.org/gerrit/#/c/16208" }, { - "type": "WEB", - "url": "https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1611_CVE-2015-1612_openflowplugin:_topology_spoofing_via_LLDP" + "type": "PACKAGE", + "url": "https://github.com/opendaylight/openflowplugin" }, { "type": "WEB", - "url": "http://www.internetsociety.org/sites/default/files/10_4_2.pdf" + "url": "https://web.archive.org/web/20150510044305/https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1611_CVE-2015-1612_openflowplugin:_topology_spoofing_via_LLDP" }, { "type": "WEB", - "url": "http://www.securityfocus.com/bid/73254" + "url": "https://web.archive.org/web/20150701104709/https://www.internetsociety.org/sites/default/files/10_4_2.pdf" } ], "database_specific": { @@ -49,8 +66,8 @@ "CWE-20" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T17:32:34Z", "nvd_published_at": "2017-04-04T17:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json b/advisories/github-reviewed/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json rename to advisories/github-reviewed/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json index 89b62c2efeb..a8f1af1b41c 100644 --- a/advisories/unreviewed/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json +++ b/advisories/github-reviewed/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-r64j-5w3w-fp49", - "modified": "2025-04-20T03:35:57Z", + "modified": "2025-04-22T17:33:24Z", "published": "2022-05-17T02:49:24Z", "aliases": [ "CVE-2015-7564" ], + "summary": "TeamPass vulnerable to SQL Injection", "details": "Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) connections_logs, (b) errors_logs or (c) access_logs action to view.query.php.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "nilsteampassnet/teampass" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.25" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -23,6 +44,10 @@ "type": "WEB", "url": "https://github.com/nilsteampassnet/TeamPass/pull/1140" }, + { + "type": "PACKAGE", + "url": "https://github.com/nilsteampassnet/TeamPass" + }, { "type": "WEB", "url": "https://www.exploit-db.com/exploits/39559" @@ -33,8 +58,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T17:33:24Z", "nvd_published_at": "2017-04-12T22:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-49wf-927p-jpvj/GHSA-49wf-927p-jpvj.json b/advisories/unreviewed/2022/05/GHSA-49wf-927p-jpvj/GHSA-49wf-927p-jpvj.json deleted file mode 100644 index bb88afd237b..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-49wf-927p-jpvj/GHSA-49wf-927p-jpvj.json +++ /dev/null @@ -1,56 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-49wf-927p-jpvj", - "modified": "2025-04-20T03:35:26Z", - "published": "2022-05-17T02:50:39Z", - "aliases": [ - "CVE-2015-1611" - ], - "details": "OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to \"fake LLDP injection.\"", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1611" - }, - { - "type": "WEB", - "url": "https://cloudrouter.org/security" - }, - { - "type": "WEB", - "url": "https://git.opendaylight.org/gerrit/#/c/16193" - }, - { - "type": "WEB", - "url": "https://git.opendaylight.org/gerrit/#/c/16208" - }, - { - "type": "WEB", - "url": "https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1611_CVE-2015-1612_openflowplugin:_topology_spoofing_via_LLDP" - }, - { - "type": "WEB", - "url": "http://www.internetsociety.org/sites/default/files/10_4_2.pdf" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/73254" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-04-04T17:59:00Z" - } -} \ No newline at end of file