diff --git a/advisories/github-reviewed/2021/09/GHSA-c36v-fmgq-m8hx/GHSA-c36v-fmgq-m8hx.json b/advisories/github-reviewed/2021/09/GHSA-c36v-fmgq-m8hx/GHSA-c36v-fmgq-m8hx.json index b38f299b594..c03e42b1587 100644 --- a/advisories/github-reviewed/2021/09/GHSA-c36v-fmgq-m8hx/GHSA-c36v-fmgq-m8hx.json +++ b/advisories/github-reviewed/2021/09/GHSA-c36v-fmgq-m8hx/GHSA-c36v-fmgq-m8hx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c36v-fmgq-m8hx", - "modified": "2022-09-11T22:24:21Z", + "modified": "2024-04-25T22:09:12Z", "published": "2021-09-07T22:57:14Z", "aliases": [ "CVE-2021-3757" @@ -25,7 +25,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "7.0.0" }, { "fixed": "9.0.6" diff --git a/advisories/github-reviewed/2022/05/GHSA-2r5h-6r7v-5m7c/GHSA-2r5h-6r7v-5m7c.json b/advisories/github-reviewed/2022/05/GHSA-2r5h-6r7v-5m7c/GHSA-2r5h-6r7v-5m7c.json new file mode 100644 index 00000000000..b75164990c5 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-2r5h-6r7v-5m7c/GHSA-2r5h-6r7v-5m7c.json @@ -0,0 +1,97 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2r5h-6r7v-5m7c", + "modified": "2024-04-25T22:09:29Z", + "published": "2022-05-17T01:36:50Z", + "aliases": [ + "CVE-2013-1348" + ], + "summary": "Symphony Vulnerable to PHP Code Injection via YAML Parsing", + "details": "The `Yaml::parse` function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "symfony/symfony" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.22" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "symfony/yaml" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.22" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1348" + }, + { + "type": "WEB", + "url": "https://github.com/symfony/symfony/commit/ac756bf39e646b4e130fad058d10a0228dbd9779" + }, + { + "type": "WEB", + "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81550" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2013-1348.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2013-1348.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/symfony/symfony" + }, + { + "type": "WEB", + "url": "https://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20150612022223/http://www.securityfocus.com/bid/57574" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T22:09:29Z", + "nvd_published_at": "2014-06-02T15:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-5c58-w9xc-qcj9/GHSA-5c58-w9xc-qcj9.json b/advisories/github-reviewed/2022/05/GHSA-5c58-w9xc-qcj9/GHSA-5c58-w9xc-qcj9.json new file mode 100644 index 00000000000..78dec3228ba --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-5c58-w9xc-qcj9/GHSA-5c58-w9xc-qcj9.json @@ -0,0 +1,181 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5c58-w9xc-qcj9", + "modified": "2024-04-25T22:09:04Z", + "published": "2022-05-17T03:34:11Z", + "aliases": [ + "CVE-2015-2308" + ], + "summary": "Symfony Vulnerable to PHP Eval Injection", + "details": "Applications with ESI support (and SSI support as of Symfony 2.6) enabled and using the Symfony built-in reverse proxy (the `Symfony\\Component\\HttpKernel\\HttpCache class) are vulnerable to PHP code injection; a malicious user can inject PHP code that will be executed by the server.\n\nHttpCache uses eval() to execute files in its cache when they contain ESI tags (and only when ESI is enabled). The vulnerability comes from the fact that PHP allows contents of