Publish Advisories

GHSA-j327-c69h-4gh8
GHSA-hxjc-9j8v-v9pr

advisories/github-reviewed/2023/05/GHSA-j327-c69h-4gh8/GHSA-j327-c69h-4gh8.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-j327-c69h-4gh8",
-  "modified": "2023-05-30T15:30:27Z",
+  "modified": "2023-11-16T21:03:49Z",
   "published": "2023-05-30T15:30:27Z",
   "aliases": [
     "CVE-2023-2980"
   ],
+  "summary": "Abstrium Pydio Cells Resource Injection vulnerability",
   "details": "A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remotely. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230212.",
   "severity": [
     {
@@ -14,13 +15,35 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/pydio/cells/v4"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "4.2.1"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2980"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/pydio/cells"
+    },
     {
       "type": "WEB",
       "url": "https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be"
@@ -44,8 +67,8 @@
       "CWE-99"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-11-16T21:03:49Z",
     "nvd_published_at": "2023-05-30T15:15:09Z"
   }
 }

advisories/github-reviewed/2023/11/GHSA-hxjc-9j8v-v9pr/GHSA-hxjc-9j8v-v9pr.json

@@ -1,12 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hxjc-9j8v-v9pr",
-  "modified": "2023-11-16T15:30:20Z",
+  "modified": "2023-11-16T21:02:40Z",
   "published": "2023-11-16T15:30:20Z",
   "aliases": [
     "CVE-2023-4771"
   ],
-  "details": "A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.",
+  "summary": "CKEditor Cross-site Scripting vulnerability",
+  "details": "A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /`ckeditor/samples/old/ajax.html` file and retrieve an authorized user's information.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -14,13 +15,35 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "ckeditor4"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "4.15.1"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4771"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/ckeditor/ckeditor4-releases"
+    },
     {
       "type": "WEB",
       "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cksource-ckeditor"
@@ -31,8 +54,8 @@
       "CWE-79"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-11-16T21:02:40Z",
     "nvd_published_at": "2023-11-16T14:15:28Z"
   }
 }