diff --git a/advisories/github-reviewed/2022/05/GHSA-j7fq-p9q7-5wfv/GHSA-j7fq-p9q7-5wfv.json b/advisories/github-reviewed/2022/05/GHSA-j7fq-p9q7-5wfv/GHSA-j7fq-p9q7-5wfv.json new file mode 100644 index 00000000000..0e53832afff --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-j7fq-p9q7-5wfv/GHSA-j7fq-p9q7-5wfv.json @@ -0,0 +1,90 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j7fq-p9q7-5wfv", + "modified": "2024-04-22T23:20:00Z", + "published": "2022-05-24T17:04:00Z", + "aliases": [ + "CVE-2019-15598" + ], + "summary": "Treekill Enables OS Command Injection", + "details": "A Code Injection exists in treekill and tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.\n\n### Steps To Reproduce:\nCreate the following PoC file:\n\n```js\nvar kill = require('treekill');\nkill('3333332 & echo \"HACKED\" > HACKED.txt & ');\n```\n\nExecute the following commands in terminal:\n\n```shell\nnpm i treekill # Install affected module\ndir # Check *HACKED.txt* doesn't exist\nnode poc.js # Run the PoC\ndir # Now *HACKED.txt* exists :)\n```\n\nThe HACKED.txt has been created", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "tree-kill" + }, + "ecosystem_specific": { + "affected_functions": [ + "(treekill)" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15598" + }, + { + "type": "WEB", + "url": "https://github.com/pkrumins/node-tree-kill/issues/30" + }, + { + "type": "WEB", + "url": "https://github.com/pkrumins/node-tree-kill/pull/31" + }, + { + "type": "WEB", + "url": "https://github.com/pkrumins/node-tree-kill/commit/ff73dbf144c4c2daa67799a50dfff59cd455c63c" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/701183" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/703415" + }, + { + "type": "WEB", + "url": "https://github.com/node-modules/treekill/blob/master/index.js#L32" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pkrumins/node-tree-kill" + }, + { + "type": "WEB", + "url": "https://security.snyk.io/vuln/SNYK-JS-TREEKILL-536781" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T23:19:59Z", + "nvd_published_at": "2019-12-18T21:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/10/GHSA-866w-wm4h-95c6/GHSA-866w-wm4h-95c6.json b/advisories/github-reviewed/2022/10/GHSA-866w-wm4h-95c6/GHSA-866w-wm4h-95c6.json new file mode 100644 index 00000000000..68f866d243c --- /dev/null +++ b/advisories/github-reviewed/2022/10/GHSA-866w-wm4h-95c6/GHSA-866w-wm4h-95c6.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-866w-wm4h-95c6", + "modified": "2024-04-22T23:20:58Z", + "published": "2022-10-12T12:00:18Z", + "aliases": [ + "CVE-2022-37617" + ], + "summary": "thlorenz browserify-shim vulnerable to prototype pollution", + "details": "Prototype pollution vulnerability in function `resolveShims` in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the `k` variable in resolve-shims.js.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "browserify-shim" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.8.16" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.8.15" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37617" + }, + { + "type": "WEB", + "url": "https://github.com/thlorenz/browserify-shim/issues/245" + }, + { + "type": "WEB", + "url": "https://github.com/thlorenz/browserify-shim/pull/246" + }, + { + "type": "WEB", + "url": "https://github.com/thlorenz/browserify-shim/commit/97855e622b6dcd117c77e6583701962ff45e7338" + }, + { + "type": "PACKAGE", + "url": "https://github.com/thlorenz/browserify-shim" + }, + { + "type": "WEB", + "url": "https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L130" + }, + { + "type": "WEB", + "url": "https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1321" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T23:20:58Z", + "nvd_published_at": "2022-10-11T23:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/10/GHSA-cfgr-75jx-h88g/GHSA-cfgr-75jx-h88g.json b/advisories/github-reviewed/2022/10/GHSA-cfgr-75jx-h88g/GHSA-cfgr-75jx-h88g.json similarity index 54% rename from advisories/unreviewed/2022/10/GHSA-cfgr-75jx-h88g/GHSA-cfgr-75jx-h88g.json rename to advisories/github-reviewed/2022/10/GHSA-cfgr-75jx-h88g/GHSA-cfgr-75jx-h88g.json index 4dec7633c95..c95832e72d6 100644 --- a/advisories/unreviewed/2022/10/GHSA-cfgr-75jx-h88g/GHSA-cfgr-75jx-h88g.json +++ b/advisories/github-reviewed/2022/10/GHSA-cfgr-75jx-h88g/GHSA-cfgr-75jx-h88g.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-cfgr-75jx-h88g", - "modified": "2022-11-01T19:00:28Z", + "modified": "2024-04-22T23:20:54Z", "published": "2022-10-31T19:00:36Z", "aliases": [ "CVE-2022-37623" ], + "summary": "thlorenz browserify-shim vulnerable to prototype pollution", "details": "Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "browserify-shim" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.8.16" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.8.15" + } + } ], "references": [ { @@ -25,6 +47,18 @@ "type": "WEB", "url": "https://github.com/thlorenz/browserify-shim/issues/248" }, + { + "type": "WEB", + "url": "https://github.com/thlorenz/browserify-shim/pull/246" + }, + { + "type": "WEB", + "url": "https://github.com/thlorenz/browserify-shim/commit/97855e622b6dcd117c77e6583701962ff45e7338" + }, + { + "type": "PACKAGE", + "url": "https://github.com/thlorenz/browserify-shim" + }, { "type": "WEB", "url": "https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158" @@ -39,8 +73,8 @@ "CWE-1321" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T23:20:54Z", "nvd_published_at": "2022-10-31T12:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/10/GHSA-r737-347m-wqc7/GHSA-r737-347m-wqc7.json b/advisories/github-reviewed/2022/10/GHSA-r737-347m-wqc7/GHSA-r737-347m-wqc7.json similarity index 54% rename from advisories/unreviewed/2022/10/GHSA-r737-347m-wqc7/GHSA-r737-347m-wqc7.json rename to advisories/github-reviewed/2022/10/GHSA-r737-347m-wqc7/GHSA-r737-347m-wqc7.json index f9a72d8a79c..b056c257f60 100644 --- a/advisories/unreviewed/2022/10/GHSA-r737-347m-wqc7/GHSA-r737-347m-wqc7.json +++ b/advisories/github-reviewed/2022/10/GHSA-r737-347m-wqc7/GHSA-r737-347m-wqc7.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-r737-347m-wqc7", - "modified": "2022-11-03T19:00:27Z", + "modified": "2024-04-22T23:20:55Z", "published": "2022-10-29T12:00:47Z", "aliases": [ "CVE-2022-37621" ], + "summary": "thlorenz browserify-shim vulnerable to prototype pollution", "details": "Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "browserify-shim" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.8.16" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.8.15" + } + } ], "references": [ { @@ -25,6 +47,18 @@ "type": "WEB", "url": "https://github.com/thlorenz/browserify-shim/issues/247" }, + { + "type": "WEB", + "url": "https://github.com/thlorenz/browserify-shim/pull/246" + }, + { + "type": "WEB", + "url": "https://github.com/thlorenz/browserify-shim/commit/97855e622b6dcd117c77e6583701962ff45e7338" + }, + { + "type": "PACKAGE", + "url": "https://github.com/thlorenz/browserify-shim" + }, { "type": "WEB", "url": "https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158" @@ -39,8 +73,8 @@ "CWE-1321" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T23:20:55Z", "nvd_published_at": "2022-10-28T20:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-j7fq-p9q7-5wfv/GHSA-j7fq-p9q7-5wfv.json b/advisories/unreviewed/2022/05/GHSA-j7fq-p9q7-5wfv/GHSA-j7fq-p9q7-5wfv.json deleted file mode 100644 index bd7145b5b9d..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-j7fq-p9q7-5wfv/GHSA-j7fq-p9q7-5wfv.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-j7fq-p9q7-5wfv", - "modified": "2022-05-24T17:04:00Z", - "published": "2022-05-24T17:04:00Z", - "aliases": [ - "CVE-2019-15598" - ], - "details": "A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15598" - }, - { - "type": "WEB", - "url": "https://hackerone.com/reports/703415" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-78" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-12-18T21:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/10/GHSA-866w-wm4h-95c6/GHSA-866w-wm4h-95c6.json b/advisories/unreviewed/2022/10/GHSA-866w-wm4h-95c6/GHSA-866w-wm4h-95c6.json deleted file mode 100644 index f6adc07f7fd..00000000000 --- a/advisories/unreviewed/2022/10/GHSA-866w-wm4h-95c6/GHSA-866w-wm4h-95c6.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-866w-wm4h-95c6", - "modified": "2022-10-13T19:00:21Z", - "published": "2022-10-12T12:00:18Z", - "aliases": [ - "CVE-2022-37617" - ], - "details": "Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37617" - }, - { - "type": "WEB", - "url": "https://github.com/thlorenz/browserify-shim/issues/245" - }, - { - "type": "WEB", - "url": "https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L130" - }, - { - "type": "WEB", - "url": "https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-1321" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-10-11T23:15:00Z" - } -} \ No newline at end of file