From e1990c380e4f5aaf91b6e2bcf0d37566072cecaa Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 24 Apr 2024 20:43:00 +0000 Subject: [PATCH] Publish Advisories GHSA-6frc-vfw9-wm27 GHSA-74c7-r9m3-hvj4 GHSA-7789-v767-37r5 GHSA-9986-6m4g-25f6 GHSA-9v7m-f3cv-68rw GHSA-jjgq-jq8g-24w4 GHSA-jm38-vmgp-j7rx GHSA-29qv-hhg4-6x96 --- .../GHSA-6frc-vfw9-wm27.json | 31 ++++++++++++++--- .../GHSA-74c7-r9m3-hvj4.json | 34 ++++++++++++++++--- .../GHSA-7789-v767-37r5.json | 31 ++++++++++++++--- .../GHSA-9986-6m4g-25f6.json | 31 ++++++++++++++--- .../GHSA-9v7m-f3cv-68rw.json | 31 ++++++++++++++--- .../GHSA-jjgq-jq8g-24w4.json | 31 ++++++++++++++--- .../GHSA-jm38-vmgp-j7rx.json | 34 ++++++++++++++++--- .../GHSA-29qv-hhg4-6x96.json | 34 ++++++++++++++++--- 8 files changed, 225 insertions(+), 32 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-6frc-vfw9-wm27/GHSA-6frc-vfw9-wm27.json (58%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-74c7-r9m3-hvj4/GHSA-74c7-r9m3-hvj4.json (63%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-7789-v767-37r5/GHSA-7789-v767-37r5.json (58%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-9986-6m4g-25f6/GHSA-9986-6m4g-25f6.json (59%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-9v7m-f3cv-68rw/GHSA-9v7m-f3cv-68rw.json (58%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-jjgq-jq8g-24w4/GHSA-jjgq-jq8g-24w4.json (58%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-jm38-vmgp-j7rx/GHSA-jm38-vmgp-j7rx.json (58%) rename advisories/{unreviewed => github-reviewed}/2022/09/GHSA-29qv-hhg4-6x96/GHSA-29qv-hhg4-6x96.json (60%) diff --git a/advisories/unreviewed/2022/05/GHSA-6frc-vfw9-wm27/GHSA-6frc-vfw9-wm27.json b/advisories/github-reviewed/2022/05/GHSA-6frc-vfw9-wm27/GHSA-6frc-vfw9-wm27.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-6frc-vfw9-wm27/GHSA-6frc-vfw9-wm27.json rename to advisories/github-reviewed/2022/05/GHSA-6frc-vfw9-wm27/GHSA-6frc-vfw9-wm27.json index 9b714c90d01..97feb49b3fb 100644 --- a/advisories/unreviewed/2022/05/GHSA-6frc-vfw9-wm27/GHSA-6frc-vfw9-wm27.json +++ b/advisories/github-reviewed/2022/05/GHSA-6frc-vfw9-wm27/GHSA-6frc-vfw9-wm27.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-6frc-vfw9-wm27", - "modified": "2022-05-14T03:51:58Z", + "modified": "2024-04-24T20:40:39Z", "published": "2022-05-14T03:51:58Z", "aliases": [ "CVE-2017-17900" ], + "summary": "Dolibarr SQL injection vulnerability in fourn/index.php", "details": "SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the socid parameter.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0.5" + } + ] + } + ] + } ], "references": [ { @@ -24,6 +43,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/4a5988accbb770b74105baacd5a034689272128c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +54,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:40:39Z", "nvd_published_at": "2017-12-27T17:08:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-74c7-r9m3-hvj4/GHSA-74c7-r9m3-hvj4.json b/advisories/github-reviewed/2022/05/GHSA-74c7-r9m3-hvj4/GHSA-74c7-r9m3-hvj4.json similarity index 63% rename from advisories/unreviewed/2022/05/GHSA-74c7-r9m3-hvj4/GHSA-74c7-r9m3-hvj4.json rename to advisories/github-reviewed/2022/05/GHSA-74c7-r9m3-hvj4/GHSA-74c7-r9m3-hvj4.json index da62df9721f..66f9b79bbbf 100644 --- a/advisories/unreviewed/2022/05/GHSA-74c7-r9m3-hvj4/GHSA-74c7-r9m3-hvj4.json +++ b/advisories/github-reviewed/2022/05/GHSA-74c7-r9m3-hvj4/GHSA-74c7-r9m3-hvj4.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-74c7-r9m3-hvj4", - "modified": "2022-05-17T00:53:04Z", + "modified": "2024-04-24T20:41:14Z", "published": "2022-05-17T00:53:04Z", "aliases": [ "CVE-2017-14239" ], + "summary": "Dolibarr cross-site scripting (XSS) vulnerability", "details": "Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3) CompanyZip, (4) CompanyTown, (5) Fax, (6) EMail, (7) Web, (8) ManagingDirectors, (9) Note, (10) Capital, (11) ProfId1, (12) ProfId2, (13) ProfId3, (14) ProfId4, (15) ProfId5, or (16) ProfId6 parameter to htdocs/admin/company.php.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0" + }, + { + "fixed": "6.0.1" + } + ] + } + ], + "versions": [ + "6.0.0" + ] + } ], "references": [ { @@ -24,6 +46,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +57,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:41:13Z", "nvd_published_at": "2017-09-11T09:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-7789-v767-37r5/GHSA-7789-v767-37r5.json b/advisories/github-reviewed/2022/05/GHSA-7789-v767-37r5/GHSA-7789-v767-37r5.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-7789-v767-37r5/GHSA-7789-v767-37r5.json rename to advisories/github-reviewed/2022/05/GHSA-7789-v767-37r5/GHSA-7789-v767-37r5.json index 0f58b403e24..fdfe48bfafa 100644 --- a/advisories/unreviewed/2022/05/GHSA-7789-v767-37r5/GHSA-7789-v767-37r5.json +++ b/advisories/github-reviewed/2022/05/GHSA-7789-v767-37r5/GHSA-7789-v767-37r5.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-7789-v767-37r5", - "modified": "2022-05-14T03:51:58Z", + "modified": "2024-04-24T20:40:51Z", "published": "2022-05-14T03:51:58Z", "aliases": [ "CVE-2017-17899" ], + "summary": "Dolibarr SQL injection vulnerability in adherents/subscription/info.php", "details": "SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the rowid parameter.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0.5" + } + ] + } + ] + } ], "references": [ { @@ -24,6 +43,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/4a5988accbb770b74105baacd5a034689272128c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +54,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:40:51Z", "nvd_published_at": "2017-12-27T17:08:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-9986-6m4g-25f6/GHSA-9986-6m4g-25f6.json b/advisories/github-reviewed/2022/05/GHSA-9986-6m4g-25f6/GHSA-9986-6m4g-25f6.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-9986-6m4g-25f6/GHSA-9986-6m4g-25f6.json rename to advisories/github-reviewed/2022/05/GHSA-9986-6m4g-25f6/GHSA-9986-6m4g-25f6.json index 6cdcc9062f4..15bc9768256 100644 --- a/advisories/unreviewed/2022/05/GHSA-9986-6m4g-25f6/GHSA-9986-6m4g-25f6.json +++ b/advisories/github-reviewed/2022/05/GHSA-9986-6m4g-25f6/GHSA-9986-6m4g-25f6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-9986-6m4g-25f6", - "modified": "2022-05-14T03:23:30Z", + "modified": "2024-04-24T20:40:35Z", "published": "2022-05-14T03:23:30Z", "aliases": [ "CVE-2017-18260" ], + "summary": "Dolibarr SQL injection vulnerability", "details": "Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut parameter) or comm/propal/list.php (propal_statut parameter, aka search_statut parameter).", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "7.0.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18260" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-010" @@ -31,8 +54,8 @@ "CWE-89" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:40:35Z", "nvd_published_at": "2018-04-11T03:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-9v7m-f3cv-68rw/GHSA-9v7m-f3cv-68rw.json b/advisories/github-reviewed/2022/05/GHSA-9v7m-f3cv-68rw/GHSA-9v7m-f3cv-68rw.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-9v7m-f3cv-68rw/GHSA-9v7m-f3cv-68rw.json rename to advisories/github-reviewed/2022/05/GHSA-9v7m-f3cv-68rw/GHSA-9v7m-f3cv-68rw.json index 474db3cb9bc..f8737b5ea0a 100644 --- a/advisories/unreviewed/2022/05/GHSA-9v7m-f3cv-68rw/GHSA-9v7m-f3cv-68rw.json +++ b/advisories/github-reviewed/2022/05/GHSA-9v7m-f3cv-68rw/GHSA-9v7m-f3cv-68rw.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-9v7m-f3cv-68rw", - "modified": "2022-05-14T03:52:03Z", + "modified": "2024-04-24T20:41:03Z", "published": "2022-05-14T03:52:03Z", "aliases": [ "CVE-2017-17897" ], + "summary": "Dolibarr SQL injection vulnerability in comm/multiprix.php", "details": "SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0.5" + } + ] + } + ] + } ], "references": [ { @@ -24,6 +43,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/4a5988accbb770b74105baacd5a034689272128c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +54,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:41:03Z", "nvd_published_at": "2017-12-27T17:08:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-jjgq-jq8g-24w4/GHSA-jjgq-jq8g-24w4.json b/advisories/github-reviewed/2022/05/GHSA-jjgq-jq8g-24w4/GHSA-jjgq-jq8g-24w4.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-jjgq-jq8g-24w4/GHSA-jjgq-jq8g-24w4.json rename to advisories/github-reviewed/2022/05/GHSA-jjgq-jq8g-24w4/GHSA-jjgq-jq8g-24w4.json index 84eaeadf894..0069fc7e7a0 100644 --- a/advisories/unreviewed/2022/05/GHSA-jjgq-jq8g-24w4/GHSA-jjgq-jq8g-24w4.json +++ b/advisories/github-reviewed/2022/05/GHSA-jjgq-jq8g-24w4/GHSA-jjgq-jq8g-24w4.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-jjgq-jq8g-24w4", - "modified": "2022-05-17T01:05:38Z", + "modified": "2024-04-24T20:41:24Z", "published": "2022-05-17T01:05:38Z", "aliases": [ "CVE-2017-14242" ], + "summary": "Dolibarr SQL injection vulnerability in don/list.php", "details": "SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0.1" + } + ] + } + ] + } ], "references": [ { @@ -24,6 +43,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/33e2179b65331d9d9179b59d746817c5be1fecdb" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -31,8 +54,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:41:24Z", "nvd_published_at": "2017-09-11T09:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-jm38-vmgp-j7rx/GHSA-jm38-vmgp-j7rx.json b/advisories/github-reviewed/2022/05/GHSA-jm38-vmgp-j7rx/GHSA-jm38-vmgp-j7rx.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-jm38-vmgp-j7rx/GHSA-jm38-vmgp-j7rx.json rename to advisories/github-reviewed/2022/05/GHSA-jm38-vmgp-j7rx/GHSA-jm38-vmgp-j7rx.json index 88ad67bd51a..19ffa239073 100644 --- a/advisories/unreviewed/2022/05/GHSA-jm38-vmgp-j7rx/GHSA-jm38-vmgp-j7rx.json +++ b/advisories/github-reviewed/2022/05/GHSA-jm38-vmgp-j7rx/GHSA-jm38-vmgp-j7rx.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-jm38-vmgp-j7rx", - "modified": "2022-05-14T03:51:58Z", + "modified": "2024-04-24T20:40:45Z", "published": "2022-05-14T03:51:58Z", "aliases": [ "CVE-2017-17898" ], + "summary": "Dolibarr sensitive information disclosure", "details": "Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 6.0.4" + } + } ], "references": [ { @@ -28,6 +50,10 @@ { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/6a62e139604dbbd5729e57df2433b37a5950c35c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" } ], "database_specific": { @@ -35,8 +61,8 @@ "CWE-200" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:40:45Z", "nvd_published_at": "2017-12-27T17:08:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/09/GHSA-29qv-hhg4-6x96/GHSA-29qv-hhg4-6x96.json b/advisories/github-reviewed/2022/09/GHSA-29qv-hhg4-6x96/GHSA-29qv-hhg4-6x96.json similarity index 60% rename from advisories/unreviewed/2022/09/GHSA-29qv-hhg4-6x96/GHSA-29qv-hhg4-6x96.json rename to advisories/github-reviewed/2022/09/GHSA-29qv-hhg4-6x96/GHSA-29qv-hhg4-6x96.json index d39a0da4fe0..73c5f5f784a 100644 --- a/advisories/unreviewed/2022/09/GHSA-29qv-hhg4-6x96/GHSA-29qv-hhg4-6x96.json +++ b/advisories/github-reviewed/2022/09/GHSA-29qv-hhg4-6x96/GHSA-29qv-hhg4-6x96.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-29qv-hhg4-6x96", - "modified": "2022-09-10T00:00:35Z", + "modified": "2024-04-24T20:41:54Z", "published": "2022-09-07T00:01:53Z", "aliases": [ "CVE-2022-34867" ], + "summary": "Unauthenticated Sensitive Information Disclosure vulnerability", "details": "Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 at WordPress allows attackers to list and delete submissions. Affects only versions from 2.0.0 to 2.0.8.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "libreform/libreform" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.9" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.0.8" + } + } ], "references": [ { @@ -25,6 +47,10 @@ "type": "WEB", "url": "https://github.com/libreform/libreform/pull/54/files" }, + { + "type": "PACKAGE", + "url": "https://github.com/libreform/libreform" + }, { "type": "WEB", "url": "https://patchstack.com/database/vulnerability/libreform/wordpress-wp-libre-form-2-plugin-2-0-8-unauthenticated-sensitive-information-disclosure-vulnerability" @@ -36,8 +62,8 @@ "CWE-668" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:41:54Z", "nvd_published_at": "2022-09-06T18:15:00Z" } } \ No newline at end of file