diff --git a/advisories/unreviewed/2022/05/GHSA-mgw4-gv3f-g57j/GHSA-mgw4-gv3f-g57j.json b/advisories/github-reviewed/2022/05/GHSA-mgw4-gv3f-g57j/GHSA-mgw4-gv3f-g57j.json similarity index 52% rename from advisories/unreviewed/2022/05/GHSA-mgw4-gv3f-g57j/GHSA-mgw4-gv3f-g57j.json rename to advisories/github-reviewed/2022/05/GHSA-mgw4-gv3f-g57j/GHSA-mgw4-gv3f-g57j.json index 19c629c3ade..f3b3142691d 100644 --- a/advisories/unreviewed/2022/05/GHSA-mgw4-gv3f-g57j/GHSA-mgw4-gv3f-g57j.json +++ b/advisories/github-reviewed/2022/05/GHSA-mgw4-gv3f-g57j/GHSA-mgw4-gv3f-g57j.json @@ -1,14 +1,40 @@ { "schema_version": "1.4.0", "id": "GHSA-mgw4-gv3f-g57j", - "modified": "2025-04-09T04:18:19Z", + "modified": "2025-04-10T12:23:11Z", "published": "2022-05-02T06:11:45Z", "aliases": [ "CVE-2010-0329" ], + "summary": "TYPO3 powermail Extension Vulnerable to SQL Injection via Unspecified Vectors", "details": "SQL injection vulnerability in the powermail extension 1.5.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to the \"SQL selection field\" and \"typoscript.\"", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "in2code/powermail" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.2" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -16,7 +42,7 @@ }, { "type": "WEB", - "url": "http://secunia.com/advisories/38167" + "url": "https://web.archive.org/web/20100123124044/http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021" }, { "type": "WEB", @@ -25,10 +51,6 @@ { "type": "WEB", "url": "http://typo3.org/extensions/repository/view/powermail/1.5.2/info/changelog.txt" - }, - { - "type": "WEB", - "url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021" } ], "database_specific": { @@ -36,8 +58,8 @@ "CWE-89" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-10T12:23:11Z", "nvd_published_at": "2010-01-15T19:30:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-p65f-652v-35r2/GHSA-p65f-652v-35r2.json b/advisories/github-reviewed/2022/05/GHSA-p65f-652v-35r2/GHSA-p65f-652v-35r2.json new file mode 100644 index 00000000000..d5dae862d6b --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-p65f-652v-35r2/GHSA-p65f-652v-35r2.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p65f-652v-35r2", + "modified": "2025-04-10T12:22:32Z", + "published": "2022-05-02T03:52:20Z", + "aliases": [ + "CVE-2009-4160" + ], + "summary": "TYPO3 Simple Download-System with Counter and Categories Vulnerable to Information Disclosure", + "details": "Unspecified vulnerability in the Simple download-system with counter and categories (kk_downloader) extension 1.2.1 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "jweiland/kk-downloader" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4160" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jweiland-net/kk_downloader" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20091219105714/http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-017" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20200228220902/http://www.securityfocus.com/bid/37168" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-10T12:22:32Z", + "nvd_published_at": "2009-12-02T17:30:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-p65f-652v-35r2/GHSA-p65f-652v-35r2.json b/advisories/unreviewed/2022/05/GHSA-p65f-652v-35r2/GHSA-p65f-652v-35r2.json deleted file mode 100644 index d3b2ae36b24..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-p65f-652v-35r2/GHSA-p65f-652v-35r2.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-p65f-652v-35r2", - "modified": "2025-04-09T04:16:53Z", - "published": "2022-05-02T03:52:20Z", - "aliases": [ - "CVE-2009-4160" - ], - "details": "Unspecified vulnerability in the Simple download-system with counter and categories (kk_downloader) extension 1.2.1 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4160" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/37550" - }, - { - "type": "WEB", - "url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-017" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/37168" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2009-12-02T17:30:00Z" - } -} \ No newline at end of file