diff --git a/advisories/unreviewed/2023/05/GHSA-j327-c69h-4gh8/GHSA-j327-c69h-4gh8.json b/advisories/github-reviewed/2023/05/GHSA-j327-c69h-4gh8/GHSA-j327-c69h-4gh8.json similarity index 70% rename from advisories/unreviewed/2023/05/GHSA-j327-c69h-4gh8/GHSA-j327-c69h-4gh8.json rename to advisories/github-reviewed/2023/05/GHSA-j327-c69h-4gh8/GHSA-j327-c69h-4gh8.json index b1155b7397b..6d681950d92 100644 --- a/advisories/unreviewed/2023/05/GHSA-j327-c69h-4gh8/GHSA-j327-c69h-4gh8.json +++ b/advisories/github-reviewed/2023/05/GHSA-j327-c69h-4gh8/GHSA-j327-c69h-4gh8.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-j327-c69h-4gh8", - "modified": "2023-05-30T15:30:27Z", + "modified": "2023-11-16T21:03:49Z", "published": "2023-05-30T15:30:27Z", "aliases": [ "CVE-2023-2980" ], + "summary": "Abstrium Pydio Cells Resource Injection vulnerability", "details": "A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remotely. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230212.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/pydio/cells/v4" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.2.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2980" }, + { + "type": "PACKAGE", + "url": "https://github.com/pydio/cells" + }, { "type": "WEB", "url": "https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be" @@ -44,8 +67,8 @@ "CWE-99" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-11-16T21:03:49Z", "nvd_published_at": "2023-05-30T15:15:09Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/11/GHSA-hxjc-9j8v-v9pr/GHSA-hxjc-9j8v-v9pr.json b/advisories/github-reviewed/2023/11/GHSA-hxjc-9j8v-v9pr/GHSA-hxjc-9j8v-v9pr.json similarity index 52% rename from advisories/unreviewed/2023/11/GHSA-hxjc-9j8v-v9pr/GHSA-hxjc-9j8v-v9pr.json rename to advisories/github-reviewed/2023/11/GHSA-hxjc-9j8v-v9pr/GHSA-hxjc-9j8v-v9pr.json index 75dc34861f2..157c0734310 100644 --- a/advisories/unreviewed/2023/11/GHSA-hxjc-9j8v-v9pr/GHSA-hxjc-9j8v-v9pr.json +++ b/advisories/github-reviewed/2023/11/GHSA-hxjc-9j8v-v9pr/GHSA-hxjc-9j8v-v9pr.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-hxjc-9j8v-v9pr", - "modified": "2023-11-16T15:30:20Z", + "modified": "2023-11-16T21:02:40Z", "published": "2023-11-16T15:30:20Z", "aliases": [ "CVE-2023-4771" ], - "details": "A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.", + "summary": "CKEditor Cross-site Scripting vulnerability", + "details": "A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /`ckeditor/samples/old/ajax.html` file and retrieve an authorized user's information.", "severity": [ { "type": "CVSS_V3", @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "ckeditor4" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.15.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4771" }, + { + "type": "PACKAGE", + "url": "https://github.com/ckeditor/ckeditor4-releases" + }, { "type": "WEB", "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cksource-ckeditor" @@ -31,8 +54,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-11-16T21:02:40Z", "nvd_published_at": "2023-11-16T14:15:28Z" } } \ No newline at end of file