diff --git a/advisories/github-reviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json b/advisories/github-reviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json new file mode 100644 index 00000000000..17ae9af2dd7 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json @@ -0,0 +1,130 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-55g3-fjwm-w2c8", + "modified": "2025-04-14T16:01:20Z", + "published": "2022-05-14T04:01:57Z", + "aliases": [ + "CVE-2014-3942" + ], + "summary": "TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code", + "details": "The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.5.0" + }, + { + "fixed": "4.5.34" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.7.0" + }, + { + "fixed": "4.7.19" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0" + }, + { + "fixed": "6.0.14" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.1.0" + }, + { + "fixed": "6.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3942" + }, + { + "type": "PACKAGE", + "url": "https://github.com/TYPO3/typo3" + }, + { + "type": "WEB", + "url": "https://typo3.org/security/advisory/typo3-core-sa-2014-001" + }, + { + "type": "WEB", + "url": "http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html" + }, + { + "type": "WEB", + "url": "http://www.debian.org/security/2014/dsa-2942" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2014/06/03/2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-14T16:01:20Z", + "nvd_published_at": "2014-06-03T14:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json b/advisories/github-reviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json new file mode 100644 index 00000000000..4712d9311d6 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m76j-69c2-c3m8", + "modified": "2025-04-14T16:00:18Z", + "published": "2022-05-17T04:43:27Z", + "aliases": [ + "CVE-2013-4321" + ], + "summary": "TYPO3 vulnerable to remote authenticated arbitrary code execution", + "details": "The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0" + }, + { + "fixed": "6.0.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.1.0" + }, + { + "fixed": "6.1.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4321" + }, + { + "type": "PACKAGE", + "url": "https://github.com/TYPO3/typo3" + }, + { + "type": "WEB", + "url": "https://typo3.org/security/advisory/typo3-core-sa-2013-003" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-14T16:00:18Z", + "nvd_published_at": "2014-05-20T14:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json b/advisories/unreviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json deleted file mode 100644 index d659f072a29..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-55g3-fjwm-w2c8", - "modified": "2025-04-12T12:34:25Z", - "published": "2022-05-14T04:01:57Z", - "aliases": [ - "CVE-2014-3942" - ], - "details": "The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3942" - }, - { - "type": "WEB", - "url": "http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html" - }, - { - "type": "WEB", - "url": "http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001" - }, - { - "type": "WEB", - "url": "http://www.debian.org/security/2014/dsa-2942" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2014/06/03/2" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-06-03T14:55:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json b/advisories/unreviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json deleted file mode 100644 index 29f32acc2ae..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-m76j-69c2-c3m8", - "modified": "2025-04-12T12:33:54Z", - "published": "2022-05-17T04:43:27Z", - "aliases": [ - "CVE-2013-4321" - ], - "details": "The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4321" - }, - { - "type": "WEB", - "url": "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-05-20T14:55:00Z" - } -} \ No newline at end of file