diff --git a/advisories/github-reviewed/2022/05/GHSA-42vg-q6mw-cfh5/GHSA-42vg-q6mw-cfh5.json b/advisories/github-reviewed/2022/05/GHSA-42vg-q6mw-cfh5/GHSA-42vg-q6mw-cfh5.json new file mode 100644 index 00000000000..341ea6f3f9d --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-42vg-q6mw-cfh5/GHSA-42vg-q6mw-cfh5.json @@ -0,0 +1,79 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-42vg-q6mw-cfh5", + "modified": "2025-04-12T02:31:32Z", + "published": "2022-05-17T05:18:41Z", + "aliases": [ + "CVE-2012-1826" + ], + "summary": "dotCMS allows remote authenticated users to execute arbitrary Java code", + "details": "dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.dotcms:dotcms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.9" + }, + { + "fixed": "1.9.5.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1826" + }, + { + "type": "WEB", + "url": "https://github.com/dotCMS/dotCMS/issues/261" + }, + { + "type": "WEB", + "url": "https://github.com/dotCMS/dotCMS/issues/281" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dotCMS/dotCMS" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20201208044614/https://gist.github.com/jtesser/2627440" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20210124000108/https://www.securityfocus.com/bid/53688" + }, + { + "type": "WEB", + "url": "http://dotcms.com/dotCMSVersions" + }, + { + "type": "WEB", + "url": "http://www.kb.cert.org/vuls/id/898083" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T02:31:18Z", + "nvd_published_at": "2012-06-08T16:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-66j3-66cp-6c2m/GHSA-66j3-66cp-6c2m.json b/advisories/github-reviewed/2022/05/GHSA-66j3-66cp-6c2m/GHSA-66j3-66cp-6c2m.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-66j3-66cp-6c2m/GHSA-66j3-66cp-6c2m.json rename to advisories/github-reviewed/2022/05/GHSA-66j3-66cp-6c2m/GHSA-66j3-66cp-6c2m.json index 7415b6ff604..b9dd512c742 100644 --- a/advisories/unreviewed/2022/05/GHSA-66j3-66cp-6c2m/GHSA-66j3-66cp-6c2m.json +++ b/advisories/github-reviewed/2022/05/GHSA-66j3-66cp-6c2m/GHSA-66j3-66cp-6c2m.json @@ -1,14 +1,78 @@ { "schema_version": "1.4.0", "id": "GHSA-66j3-66cp-6c2m", - "modified": "2025-04-11T03:58:00Z", + "modified": "2025-04-12T02:30:59Z", "published": "2022-05-17T01:55:58Z", "aliases": [ "CVE-2010-5099" ], + "summary": "TYPO3 Path Traversal vulnerability", "details": "The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files, as demonstrated using path traversal sequences with %00 null bytes and CVE-2010-3714 to read the TYPO3 encryption key from localconf.php.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.16" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.4.0" + }, + { + "fixed": "4.4.5" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -18,18 +82,18 @@ "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64180" }, + { + "type": "PACKAGE", + "url": "https://github.com/TYPO3/typo3" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20120801235059/http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022" + }, { "type": "WEB", "url": "http://blog.nibblesec.org/2010/12/typo3-sa-2010-020-typo3-sa-2010-022.html" }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/35770" - }, - { - "type": "WEB", - "url": "http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022" - }, { "type": "WEB", "url": "http://www.exploit-db.com/exploits/15856" @@ -53,11 +117,12 @@ ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-22" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T02:30:59Z", "nvd_published_at": "2012-05-30T20:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-8hxm-42v5-66hm/GHSA-8hxm-42v5-66hm.json b/advisories/github-reviewed/2022/05/GHSA-8hxm-42v5-66hm/GHSA-8hxm-42v5-66hm.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-8hxm-42v5-66hm/GHSA-8hxm-42v5-66hm.json rename to advisories/github-reviewed/2022/05/GHSA-8hxm-42v5-66hm/GHSA-8hxm-42v5-66hm.json index 50e5bfe97ee..dd7dce6fe00 100644 --- a/advisories/unreviewed/2022/05/GHSA-8hxm-42v5-66hm/GHSA-8hxm-42v5-66hm.json +++ b/advisories/github-reviewed/2022/05/GHSA-8hxm-42v5-66hm/GHSA-8hxm-42v5-66hm.json @@ -1,14 +1,59 @@ { "schema_version": "1.4.0", "id": "GHSA-8hxm-42v5-66hm", - "modified": "2025-04-11T03:59:08Z", + "modified": "2025-04-12T02:32:03Z", "published": "2022-05-13T01:13:14Z", "aliases": [ "CVE-2011-4298" ], + "summary": "Moodle vulnerable to Cross-Site Request Forgery", "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.1.0" + }, + { + "fixed": "2.1.2" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -18,6 +63,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=747444" }, + { + "type": "PACKAGE", + "url": "https://git.moodle.org" + }, { "type": "WEB", "url": "http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=48346fb11f8ced06a05c0618b02a3a925b34ec59" @@ -36,8 +85,8 @@ "CWE-352" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T02:32:03Z", "nvd_published_at": "2012-07-11T10:26:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-r2w2-2r2x-fpcx/GHSA-r2w2-2r2x-fpcx.json b/advisories/github-reviewed/2022/05/GHSA-r2w2-2r2x-fpcx/GHSA-r2w2-2r2x-fpcx.json new file mode 100644 index 00000000000..21776df5cbc --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-r2w2-2r2x-fpcx/GHSA-r2w2-2r2x-fpcx.json @@ -0,0 +1,118 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r2w2-2r2x-fpcx", + "modified": "2025-04-12T02:30:20Z", + "published": "2022-05-17T01:55:53Z", + "aliases": [ + "CVE-2010-5103" + ], + "summary": "TYPO3 SQL Injection vulnerability", + "details": "SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.", + "severity": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.16" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "typo3/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.4.0" + }, + { + "fixed": "4.4.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5103" + }, + { + "type": "WEB", + "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64184" + }, + { + "type": "PACKAGE", + "url": "https://github.com/TYPO3/typo3" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20120123102224/http://www.securityfocus.com/bid/45470" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20120801235059/http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2011/01/13/2" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2012/05/10/7" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2012/05/11/3" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2012/05/12/5" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T02:30:19Z", + "nvd_published_at": "2012-05-21T20:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-42vg-q6mw-cfh5/GHSA-42vg-q6mw-cfh5.json b/advisories/unreviewed/2022/05/GHSA-42vg-q6mw-cfh5/GHSA-42vg-q6mw-cfh5.json deleted file mode 100644 index 6c77560a83b..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-42vg-q6mw-cfh5/GHSA-42vg-q6mw-cfh5.json +++ /dev/null @@ -1,57 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-42vg-q6mw-cfh5", - "modified": "2025-04-11T03:58:14Z", - "published": "2022-05-17T05:18:41Z", - "aliases": [ - "CVE-2012-1826" - ], - "details": "dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1826" - }, - { - "type": "WEB", - "url": "https://github.com/dotCMS/dotCMS/issues/261" - }, - { - "type": "WEB", - "url": "https://github.com/dotCMS/dotCMS/issues/281" - }, - { - "type": "WEB", - "url": "https://gist.github.com/2627440" - }, - { - "type": "WEB", - "url": "http://dotcms.com/dotCMSVersions" - }, - { - "type": "WEB", - "url": "http://osvdb.org/82240" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/49276" - }, - { - "type": "WEB", - "url": "http://www.kb.cert.org/vuls/id/898083" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/53688" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2012-06-08T16:55:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-r2w2-2r2x-fpcx/GHSA-r2w2-2r2x-fpcx.json b/advisories/unreviewed/2022/05/GHSA-r2w2-2r2x-fpcx/GHSA-r2w2-2r2x-fpcx.json deleted file mode 100644 index c28d4722a99..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-r2w2-2r2x-fpcx/GHSA-r2w2-2r2x-fpcx.json +++ /dev/null @@ -1,63 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-r2w2-2r2x-fpcx", - "modified": "2025-04-11T03:57:49Z", - "published": "2022-05-17T01:55:53Z", - "aliases": [ - "CVE-2010-5103" - ], - "details": "SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5103" - }, - { - "type": "WEB", - "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64184" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/35770" - }, - { - "type": "WEB", - "url": "http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2011/01/13/2" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2012/05/10/7" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2012/05/11/3" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2012/05/12/5" - }, - { - "type": "WEB", - "url": "http://www.osvdb.org/70117" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/45470" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-89" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2012-05-21T20:55:00Z" - } -} \ No newline at end of file