From d1b3a660354ab688c14911abb2e3f41cca93c041 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 16 Nov 2023 21:04:21 +0000
Subject: [PATCH] Publish Advisories

GHSA-j327-c69h-4gh8
GHSA-hxjc-9j8v-v9pr
---
 .../GHSA-j327-c69h-4gh8.json                  | 31 ++++++++++++++---
 .../GHSA-hxjc-9j8v-v9pr.json                  | 33 ++++++++++++++++---
 2 files changed, 55 insertions(+), 9 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2023/05/GHSA-j327-c69h-4gh8/GHSA-j327-c69h-4gh8.json (70%)
 rename advisories/{unreviewed => github-reviewed}/2023/11/GHSA-hxjc-9j8v-v9pr/GHSA-hxjc-9j8v-v9pr.json (52%)

diff --git a/advisories/unreviewed/2023/05/GHSA-j327-c69h-4gh8/GHSA-j327-c69h-4gh8.json b/advisories/github-reviewed/2023/05/GHSA-j327-c69h-4gh8/GHSA-j327-c69h-4gh8.json
similarity index 70%
rename from advisories/unreviewed/2023/05/GHSA-j327-c69h-4gh8/GHSA-j327-c69h-4gh8.json
rename to advisories/github-reviewed/2023/05/GHSA-j327-c69h-4gh8/GHSA-j327-c69h-4gh8.json
index b1155b7397b..6d681950d92 100644
--- a/advisories/unreviewed/2023/05/GHSA-j327-c69h-4gh8/GHSA-j327-c69h-4gh8.json
+++ b/advisories/github-reviewed/2023/05/GHSA-j327-c69h-4gh8/GHSA-j327-c69h-4gh8.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-j327-c69h-4gh8",
-  "modified": "2023-05-30T15:30:27Z",
+  "modified": "2023-11-16T21:03:49Z",
   "published": "2023-05-30T15:30:27Z",
   "aliases": [
     "CVE-2023-2980"
   ],
+  "summary": "Abstrium Pydio Cells Resource Injection vulnerability",
   "details": "A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remotely. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230212.",
   "severity": [
     {
@@ -14,13 +15,35 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/pydio/cells/v4"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "4.2.1"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2980"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/pydio/cells"
+    },
     {
       "type": "WEB",
       "url": "https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be"
@@ -44,8 +67,8 @@
       "CWE-99"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-11-16T21:03:49Z",
     "nvd_published_at": "2023-05-30T15:15:09Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/unreviewed/2023/11/GHSA-hxjc-9j8v-v9pr/GHSA-hxjc-9j8v-v9pr.json b/advisories/github-reviewed/2023/11/GHSA-hxjc-9j8v-v9pr/GHSA-hxjc-9j8v-v9pr.json
similarity index 52%
rename from advisories/unreviewed/2023/11/GHSA-hxjc-9j8v-v9pr/GHSA-hxjc-9j8v-v9pr.json
rename to advisories/github-reviewed/2023/11/GHSA-hxjc-9j8v-v9pr/GHSA-hxjc-9j8v-v9pr.json
index 75dc34861f2..157c0734310 100644
--- a/advisories/unreviewed/2023/11/GHSA-hxjc-9j8v-v9pr/GHSA-hxjc-9j8v-v9pr.json
+++ b/advisories/github-reviewed/2023/11/GHSA-hxjc-9j8v-v9pr/GHSA-hxjc-9j8v-v9pr.json
@@ -1,12 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hxjc-9j8v-v9pr",
-  "modified": "2023-11-16T15:30:20Z",
+  "modified": "2023-11-16T21:02:40Z",
   "published": "2023-11-16T15:30:20Z",
   "aliases": [
     "CVE-2023-4771"
   ],
-  "details": "A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.",
+  "summary": "CKEditor Cross-site Scripting vulnerability",
+  "details": "A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /`ckeditor/samples/old/ajax.html` file and retrieve an authorized user's information.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -14,13 +15,35 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "ckeditor4"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "4.15.1"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4771"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/ckeditor/ckeditor4-releases"
+    },
     {
       "type": "WEB",
       "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cksource-ckeditor"
@@ -31,8 +54,8 @@
       "CWE-79"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-11-16T21:02:40Z",
     "nvd_published_at": "2023-11-16T14:15:28Z"
   }
 }
\ No newline at end of file