diff --git a/advisories/github-reviewed/2020/09/GHSA-qh32-6jjc-qprm/GHSA-qh32-6jjc-qprm.json b/advisories/github-reviewed/2020/09/GHSA-qh32-6jjc-qprm/GHSA-qh32-6jjc-qprm.json index 947549e5497..f28b597fa70 100644 --- a/advisories/github-reviewed/2020/09/GHSA-qh32-6jjc-qprm/GHSA-qh32-6jjc-qprm.json +++ b/advisories/github-reviewed/2020/09/GHSA-qh32-6jjc-qprm/GHSA-qh32-6jjc-qprm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qh32-6jjc-qprm", - "modified": "2021-08-26T15:19:19Z", + "modified": "2024-10-28T14:48:11Z", "published": "2020-09-25T18:28:46Z", "aliases": [ "CVE-2020-15209" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ @@ -332,6 +336,18 @@ "type": "WEB", "url": "https://github.com/tensorflow/tensorflow/commit/0b5662bc2be13a8c8f044d925d87fb6e56247cd8" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-289.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-324.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-132.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/tensorflow/tensorflow" @@ -349,7 +365,7 @@ "cwe_ids": [ "CWE-476" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-09-25T18:13:03Z", "nvd_published_at": "2020-09-25T19:15:00Z" diff --git a/advisories/unreviewed/2024/10/GHSA-68qg-g787-3rp5/GHSA-68qg-g787-3rp5.json b/advisories/github-reviewed/2024/10/GHSA-68qg-g787-3rp5/GHSA-68qg-g787-3rp5.json similarity index 57% rename from advisories/unreviewed/2024/10/GHSA-68qg-g787-3rp5/GHSA-68qg-g787-3rp5.json rename to advisories/github-reviewed/2024/10/GHSA-68qg-g787-3rp5/GHSA-68qg-g787-3rp5.json index ea7f6571c8a..a2518c91bc8 100644 --- a/advisories/unreviewed/2024/10/GHSA-68qg-g787-3rp5/GHSA-68qg-g787-3rp5.json +++ b/advisories/github-reviewed/2024/10/GHSA-68qg-g787-3rp5/GHSA-68qg-g787-3rp5.json @@ -1,20 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-68qg-g787-3rp5", - "modified": "2024-10-26T21:30:46Z", + "modified": "2024-10-28T14:50:17Z", "published": "2024-10-26T21:30:46Z", "aliases": [ "CVE-2020-26306" ], + "summary": "Knwl.js Regular Expression Denial of Service vulnerability", "details": "Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.", "severity": [ { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green" } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "knwl.js" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.0.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,14 @@ "type": "WEB", "url": "https://github.com/benhmoore/Knwl/issues/106" }, + { + "type": "WEB", + "url": "https://github.com/benhmoore/Knwl/commit/88aa966b1415a167c7c91b70053b72c7762c1cc0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/benhmoore/Knwl" + }, { "type": "ADVISORY", "url": "https://securitylab.github.com/advisories/GHSL-2020-296-redos-Knwl.js" @@ -34,9 +61,9 @@ "cwe_ids": [ "CWE-1333" ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-28T14:50:17Z", "nvd_published_at": "2024-10-26T21:15:13Z" } } \ No newline at end of file