From c39930049cb0a8f0d20ad274c1be647918fd7ece Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 10 Apr 2025 12:25:09 +0000 Subject: [PATCH] Publish Advisories GHSA-mgw4-gv3f-g57j GHSA-p65f-652v-35r2 GHSA-p65f-652v-35r2 --- .../GHSA-mgw4-gv3f-g57j.json | 42 +++++++++--- .../GHSA-p65f-652v-35r2.json | 65 +++++++++++++++++++ .../GHSA-p65f-652v-35r2.json | 37 ----------- 3 files changed, 97 insertions(+), 47 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-mgw4-gv3f-g57j/GHSA-mgw4-gv3f-g57j.json (52%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-p65f-652v-35r2/GHSA-p65f-652v-35r2.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-p65f-652v-35r2/GHSA-p65f-652v-35r2.json diff --git a/advisories/unreviewed/2022/05/GHSA-mgw4-gv3f-g57j/GHSA-mgw4-gv3f-g57j.json b/advisories/github-reviewed/2022/05/GHSA-mgw4-gv3f-g57j/GHSA-mgw4-gv3f-g57j.json similarity index 52% rename from advisories/unreviewed/2022/05/GHSA-mgw4-gv3f-g57j/GHSA-mgw4-gv3f-g57j.json rename to advisories/github-reviewed/2022/05/GHSA-mgw4-gv3f-g57j/GHSA-mgw4-gv3f-g57j.json index 19c629c3ade..f3b3142691d 100644 --- a/advisories/unreviewed/2022/05/GHSA-mgw4-gv3f-g57j/GHSA-mgw4-gv3f-g57j.json +++ b/advisories/github-reviewed/2022/05/GHSA-mgw4-gv3f-g57j/GHSA-mgw4-gv3f-g57j.json @@ -1,14 +1,40 @@ { "schema_version": "1.4.0", "id": "GHSA-mgw4-gv3f-g57j", - "modified": "2025-04-09T04:18:19Z", + "modified": "2025-04-10T12:23:11Z", "published": "2022-05-02T06:11:45Z", "aliases": [ "CVE-2010-0329" ], + "summary": "TYPO3 powermail Extension Vulnerable to SQL Injection via Unspecified Vectors", "details": "SQL injection vulnerability in the powermail extension 1.5.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to the \"SQL selection field\" and \"typoscript.\"", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "in2code/powermail" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.2" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -16,7 +42,7 @@ }, { "type": "WEB", - "url": "http://secunia.com/advisories/38167" + "url": "https://web.archive.org/web/20100123124044/http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021" }, { "type": "WEB", @@ -25,10 +51,6 @@ { "type": "WEB", "url": "http://typo3.org/extensions/repository/view/powermail/1.5.2/info/changelog.txt" - }, - { - "type": "WEB", - "url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021" } ], "database_specific": { @@ -36,8 +58,8 @@ "CWE-89" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-10T12:23:11Z", "nvd_published_at": "2010-01-15T19:30:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-p65f-652v-35r2/GHSA-p65f-652v-35r2.json b/advisories/github-reviewed/2022/05/GHSA-p65f-652v-35r2/GHSA-p65f-652v-35r2.json new file mode 100644 index 00000000000..d5dae862d6b --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-p65f-652v-35r2/GHSA-p65f-652v-35r2.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p65f-652v-35r2", + "modified": "2025-04-10T12:22:32Z", + "published": "2022-05-02T03:52:20Z", + "aliases": [ + "CVE-2009-4160" + ], + "summary": "TYPO3 Simple Download-System with Counter and Categories Vulnerable to Information Disclosure", + "details": "Unspecified vulnerability in the Simple download-system with counter and categories (kk_downloader) extension 1.2.1 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "jweiland/kk-downloader" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4160" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jweiland-net/kk_downloader" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20091219105714/http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-017" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20200228220902/http://www.securityfocus.com/bid/37168" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-10T12:22:32Z", + "nvd_published_at": "2009-12-02T17:30:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-p65f-652v-35r2/GHSA-p65f-652v-35r2.json b/advisories/unreviewed/2022/05/GHSA-p65f-652v-35r2/GHSA-p65f-652v-35r2.json deleted file mode 100644 index d3b2ae36b24..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-p65f-652v-35r2/GHSA-p65f-652v-35r2.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-p65f-652v-35r2", - "modified": "2025-04-09T04:16:53Z", - "published": "2022-05-02T03:52:20Z", - "aliases": [ - "CVE-2009-4160" - ], - "details": "Unspecified vulnerability in the Simple download-system with counter and categories (kk_downloader) extension 1.2.1 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4160" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/37550" - }, - { - "type": "WEB", - "url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-017" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/37168" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2009-12-02T17:30:00Z" - } -} \ No newline at end of file