From de96ad4b9aaa6feab423ab05b07642d00d68305b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 3 May 2024 20:22:03 +0000 Subject: [PATCH] Publish Advisories GHSA-52vj-mr2j-f8jh GHSA-3rq5-2g8h-59hc GHSA-xv64-8p4r-94gq GHSA-xv64-8p4r-94gq --- .../GHSA-52vj-mr2j-f8jh.json | 4 +- .../GHSA-3rq5-2g8h-59hc.json | 10 ++- .../GHSA-xv64-8p4r-94gq.json | 68 +++++++++++++++++++ .../GHSA-xv64-8p4r-94gq.json | 38 ----------- 4 files changed, 79 insertions(+), 41 deletions(-) create mode 100644 advisories/github-reviewed/2024/05/GHSA-xv64-8p4r-94gq/GHSA-xv64-8p4r-94gq.json delete mode 100644 advisories/unreviewed/2024/05/GHSA-xv64-8p4r-94gq/GHSA-xv64-8p4r-94gq.json diff --git a/advisories/github-reviewed/2022/06/GHSA-52vj-mr2j-f8jh/GHSA-52vj-mr2j-f8jh.json b/advisories/github-reviewed/2022/06/GHSA-52vj-mr2j-f8jh/GHSA-52vj-mr2j-f8jh.json index ea571400ab4..ba845ea4e02 100644 --- a/advisories/github-reviewed/2022/06/GHSA-52vj-mr2j-f8jh/GHSA-52vj-mr2j-f8jh.json +++ b/advisories/github-reviewed/2022/06/GHSA-52vj-mr2j-f8jh/GHSA-52vj-mr2j-f8jh.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-52vj-mr2j-f8jh", - "modified": "2024-04-23T14:51:24Z", + "modified": "2024-05-03T20:20:17Z", "published": "2022-06-03T00:00:58Z", "aliases": [ "CVE-2020-28246" ], "summary": "Server-Side Template Injection in formio", - "details": "A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL. NOTE: the email templating service was removed after 2020.", + "details": "A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL. NOTE: the email templating service was removed after 2020. Additionally, the vendor disputes this issue indicating this is sandboxed and only executable by admins.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/04/GHSA-3rq5-2g8h-59hc/GHSA-3rq5-2g8h-59hc.json b/advisories/github-reviewed/2024/04/GHSA-3rq5-2g8h-59hc/GHSA-3rq5-2g8h-59hc.json index 3ea9e308dbc..57888863141 100644 --- a/advisories/github-reviewed/2024/04/GHSA-3rq5-2g8h-59hc/GHSA-3rq5-2g8h-59hc.json +++ b/advisories/github-reviewed/2024/04/GHSA-3rq5-2g8h-59hc/GHSA-3rq5-2g8h-59hc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3rq5-2g8h-59hc", - "modified": "2024-04-12T21:25:53Z", + "modified": "2024-05-03T20:21:12Z", "published": "2024-04-11T15:30:48Z", "aliases": [ "CVE-2023-29483" @@ -87,9 +87,17 @@ "type": "WEB", "url": "https://github.com/rthalley/dnspython/releases/tag/v2.6.0" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOHJOO3OM65UIUUUVDEXMCTXNM6LXZEH" + }, { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713" + }, + { + "type": "WEB", + "url": "https://www.dnspython.org" } ], "database_specific": { diff --git a/advisories/github-reviewed/2024/05/GHSA-xv64-8p4r-94gq/GHSA-xv64-8p4r-94gq.json b/advisories/github-reviewed/2024/05/GHSA-xv64-8p4r-94gq/GHSA-xv64-8p4r-94gq.json new file mode 100644 index 00000000000..3912aaf880e --- /dev/null +++ b/advisories/github-reviewed/2024/05/GHSA-xv64-8p4r-94gq/GHSA-xv64-8p4r-94gq.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xv64-8p4r-94gq", + "modified": "2024-05-03T20:20:33Z", + "published": "2024-05-02T18:30:55Z", + "aliases": [ + "CVE-2024-4216" + ], + "summary": "pgAdmin Cross-site Scripting vulnerability in /settings/store API response json payload", + "details": "pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pgAdmin4" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 8.5" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4216" + }, + { + "type": "WEB", + "url": "https://github.com/pgadmin-org/pgadmin4/issues/7282" + }, + { + "type": "WEB", + "url": "https://github.com/pgadmin-org/pgadmin4/commit/e384c9665ae2e72376be7cefa8e652efcee93767" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pgadmin-org/pgadmin4" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-05-03T20:20:33Z", + "nvd_published_at": "2024-05-02T18:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-xv64-8p4r-94gq/GHSA-xv64-8p4r-94gq.json b/advisories/unreviewed/2024/05/GHSA-xv64-8p4r-94gq/GHSA-xv64-8p4r-94gq.json deleted file mode 100644 index d54409a7e17..00000000000 --- a/advisories/unreviewed/2024/05/GHSA-xv64-8p4r-94gq/GHSA-xv64-8p4r-94gq.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xv64-8p4r-94gq", - "modified": "2024-05-02T18:30:55Z", - "published": "2024-05-02T18:30:55Z", - "aliases": [ - "CVE-2024-4216" - ], - "details": "pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end.\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4216" - }, - { - "type": "WEB", - "url": "https://github.com/pgadmin-org/pgadmin4/issues/7282" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-05-02T18:15:07Z" - } -} \ No newline at end of file