diff --git a/advisories/github-reviewed/2023/12/GHSA-rcvr-8whx-3m5p/GHSA-rcvr-8whx-3m5p.json b/advisories/github-reviewed/2023/12/GHSA-rcvr-8whx-3m5p/GHSA-rcvr-8whx-3m5p.json new file mode 100644 index 00000000000..e7c7934b920 --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-rcvr-8whx-3m5p/GHSA-rcvr-8whx-3m5p.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rcvr-8whx-3m5p", + "modified": "2024-01-03T21:42:34Z", + "published": "2023-12-30T18:30:35Z", + "aliases": [ + "CVE-2023-50550" + ], + "summary": "Layui cross-site scripting (XSS) vulnerability", + "details": "layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "layui" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.7.4" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50550" + }, + { + "type": "WEB", + "url": "https://gitee.com/layui/layui/issues/I8M1C2" + }, + { + "type": "WEB", + "url": "https://gitee.com/layui/layui/issues?utf8=%E2%9C%93&state=all&issue_search=xss" + }, + { + "type": "PACKAGE", + "url": "https://github.com/layui/layui" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T21:42:34Z", + "nvd_published_at": "2023-12-30T16:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-9w97-9rqx-8v4j/GHSA-9w97-9rqx-8v4j.json b/advisories/github-reviewed/2024/01/GHSA-9w97-9rqx-8v4j/GHSA-9w97-9rqx-8v4j.json new file mode 100644 index 00000000000..4b09852ab0c --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-9w97-9rqx-8v4j/GHSA-9w97-9rqx-8v4j.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9w97-9rqx-8v4j", + "modified": "2024-01-03T21:42:57Z", + "published": "2024-01-02T12:30:18Z", + "aliases": [ + "CVE-2023-50333" + ], + "summary": "Mattermost allows demoted guests to change group names", + "details": "Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.1.7" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 8.1.6" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50333" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost/commit/61dd452fb2fcd3ac6f7b2e050f7f0a93a92d95fc" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T21:42:57Z", + "nvd_published_at": "2024-01-02T10:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-w88v-pjr8-cmv2/GHSA-w88v-pjr8-cmv2.json b/advisories/github-reviewed/2024/01/GHSA-w88v-pjr8-cmv2/GHSA-w88v-pjr8-cmv2.json new file mode 100644 index 00000000000..908ec78f17e --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-w88v-pjr8-cmv2/GHSA-w88v-pjr8-cmv2.json @@ -0,0 +1,86 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w88v-pjr8-cmv2", + "modified": "2024-01-03T21:43:32Z", + "published": "2024-01-02T12:30:18Z", + "aliases": [ + "CVE-2023-47858" + ], + "summary": "Mattermost viewing archived public channels permissions vulnerability", + "details": "Mattermost fails to properly verify the permissions needed for viewing archived public channels,  allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams//channels/deleted endpoint.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-server/v6" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.8.10" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 7.8.9" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.1.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 8.1.0" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47858" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T21:43:32Z", + "nvd_published_at": "2024-01-02T10:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-rcvr-8whx-3m5p/GHSA-rcvr-8whx-3m5p.json b/advisories/unreviewed/2023/12/GHSA-rcvr-8whx-3m5p/GHSA-rcvr-8whx-3m5p.json deleted file mode 100644 index 132829b0de4..00000000000 --- a/advisories/unreviewed/2023/12/GHSA-rcvr-8whx-3m5p/GHSA-rcvr-8whx-3m5p.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-rcvr-8whx-3m5p", - "modified": "2023-12-30T18:30:35Z", - "published": "2023-12-30T18:30:35Z", - "aliases": [ - "CVE-2023-50550" - ], - "details": "layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50550" - }, - { - "type": "WEB", - "url": "https://gitee.com/layui/layui/issues?utf8=%E2%9C%93&state=all&issue_search=xss" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-12-30T16:15:44Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-9w97-9rqx-8v4j/GHSA-9w97-9rqx-8v4j.json b/advisories/unreviewed/2024/01/GHSA-9w97-9rqx-8v4j/GHSA-9w97-9rqx-8v4j.json deleted file mode 100644 index a160ac576dc..00000000000 --- a/advisories/unreviewed/2024/01/GHSA-9w97-9rqx-8v4j/GHSA-9w97-9rqx-8v4j.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-9w97-9rqx-8v4j", - "modified": "2024-01-02T12:30:18Z", - "published": "2024-01-02T12:30:18Z", - "aliases": [ - "CVE-2023-50333" - ], - "details": "Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names.\n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50333" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-284" - ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-01-02T10:15:08Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-w88v-pjr8-cmv2/GHSA-w88v-pjr8-cmv2.json b/advisories/unreviewed/2024/01/GHSA-w88v-pjr8-cmv2/GHSA-w88v-pjr8-cmv2.json deleted file mode 100644 index 3171a044966..00000000000 --- a/advisories/unreviewed/2024/01/GHSA-w88v-pjr8-cmv2/GHSA-w88v-pjr8-cmv2.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-w88v-pjr8-cmv2", - "modified": "2024-01-02T12:30:18Z", - "published": "2024-01-02T12:30:18Z", - "aliases": [ - "CVE-2023-47858" - ], - "details": "Mattermost fails to properly verify the permissions needed for viewing archived public channels,  allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams//channels/deleted endpoint.\n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47858" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-284" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-01-02T10:15:08Z" - } -} \ No newline at end of file