diff --git a/advisories/unreviewed/2022/05/GHSA-66gr-xrcf-8jpq/GHSA-66gr-xrcf-8jpq.json b/advisories/github-reviewed/2022/05/GHSA-66gr-xrcf-8jpq/GHSA-66gr-xrcf-8jpq.json similarity index 51% rename from advisories/unreviewed/2022/05/GHSA-66gr-xrcf-8jpq/GHSA-66gr-xrcf-8jpq.json rename to advisories/github-reviewed/2022/05/GHSA-66gr-xrcf-8jpq/GHSA-66gr-xrcf-8jpq.json index 2490c4f276e..bb9e4352c8e 100644 --- a/advisories/unreviewed/2022/05/GHSA-66gr-xrcf-8jpq/GHSA-66gr-xrcf-8jpq.json +++ b/advisories/github-reviewed/2022/05/GHSA-66gr-xrcf-8jpq/GHSA-66gr-xrcf-8jpq.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-66gr-xrcf-8jpq", - "modified": "2022-05-17T03:05:27Z", + "modified": "2024-04-23T17:17:38Z", "published": "2022-05-17T03:05:27Z", "aliases": [ "CVE-2016-9451" ], + "summary": "Drupal Open Redirect", "details": "Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.", "severity": [ { @@ -14,13 +15,54 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.52" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.2.3" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9451" }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, { "type": "WEB", "url": "https://www.drupal.org/SA-CORE-2016-005" @@ -39,8 +81,8 @@ "CWE-601" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:17:38Z", "nvd_published_at": "2016-11-25T18:59:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-frqf-9qr4-6vxf/GHSA-frqf-9qr4-6vxf.json b/advisories/github-reviewed/2022/05/GHSA-frqf-9qr4-6vxf/GHSA-frqf-9qr4-6vxf.json new file mode 100644 index 00000000000..5d21e530fd4 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-frqf-9qr4-6vxf/GHSA-frqf-9qr4-6vxf.json @@ -0,0 +1,104 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-frqf-9qr4-6vxf", + "modified": "2024-04-23T17:18:13Z", + "published": "2022-05-17T03:39:45Z", + "aliases": [ + "CVE-2016-6211" + ], + "summary": "Drupal Saving user accounts can sometimes grant the user all roles", + "details": "The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.44" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.44" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6211" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-6211.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-6211.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/SA-CORE-2016-002" + }, + { + "type": "WEB", + "url": "http://www.debian.org/security/2016/dsa-3604" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2016/07/13/4" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2016/07/13/7" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/91230" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:18:13Z", + "nvd_published_at": "2016-09-09T14:05:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-jpj8-49hr-wcwv/GHSA-jpj8-49hr-wcwv.json b/advisories/github-reviewed/2022/05/GHSA-jpj8-49hr-wcwv/GHSA-jpj8-49hr-wcwv.json new file mode 100644 index 00000000000..4915118654f --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-jpj8-49hr-wcwv/GHSA-jpj8-49hr-wcwv.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jpj8-49hr-wcwv", + "modified": "2024-04-23T17:17:43Z", + "published": "2022-05-17T03:38:38Z", + "aliases": [ + "CVE-2016-9452" + ], + "summary": "Drupal Denial of service via transliterate mechanism", + "details": "The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.2.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.2.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9452" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9452.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9452.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/SA-CORE-2016-005" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/94367" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:17:43Z", + "nvd_published_at": "2016-11-25T18:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-rfxx-gxwc-923c/GHSA-rfxx-gxwc-923c.json b/advisories/github-reviewed/2022/05/GHSA-rfxx-gxwc-923c/GHSA-rfxx-gxwc-923c.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-rfxx-gxwc-923c/GHSA-rfxx-gxwc-923c.json rename to advisories/github-reviewed/2022/05/GHSA-rfxx-gxwc-923c/GHSA-rfxx-gxwc-923c.json index a92c7cb5987..fe1871d688e 100644 --- a/advisories/unreviewed/2022/05/GHSA-rfxx-gxwc-923c/GHSA-rfxx-gxwc-923c.json +++ b/advisories/github-reviewed/2022/05/GHSA-rfxx-gxwc-923c/GHSA-rfxx-gxwc-923c.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rfxx-gxwc-923c", - "modified": "2022-05-17T03:39:45Z", + "modified": "2024-04-23T17:18:11Z", "published": "2022-05-17T03:39:45Z", "aliases": [ "CVE-2016-6212" ], + "summary": "Drupal Views can allow unauthorized users to see Statistics information", "details": "The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors.", "severity": [ { @@ -14,13 +15,62 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.1.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/drupal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0" + }, + { + "fixed": "8.1.3" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6212" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-6212.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-6212.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, { "type": "WEB", "url": "https://www.drupal.org/SA-CORE-2016-002" @@ -47,8 +97,8 @@ "CWE-200" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:18:11Z", "nvd_published_at": "2016-09-09T14:05:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-frqf-9qr4-6vxf/GHSA-frqf-9qr4-6vxf.json b/advisories/unreviewed/2022/05/GHSA-frqf-9qr4-6vxf/GHSA-frqf-9qr4-6vxf.json deleted file mode 100644 index fc1795af236..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-frqf-9qr4-6vxf/GHSA-frqf-9qr4-6vxf.json +++ /dev/null @@ -1,54 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-frqf-9qr4-6vxf", - "modified": "2022-05-17T03:39:45Z", - "published": "2022-05-17T03:39:45Z", - "aliases": [ - "CVE-2016-6211" - ], - "details": "The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6211" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/SA-CORE-2016-002" - }, - { - "type": "WEB", - "url": "http://www.debian.org/security/2016/dsa-3604" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2016/07/13/4" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2016/07/13/7" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/91230" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2016-09-09T14:05:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-jpj8-49hr-wcwv/GHSA-jpj8-49hr-wcwv.json b/advisories/unreviewed/2022/05/GHSA-jpj8-49hr-wcwv/GHSA-jpj8-49hr-wcwv.json deleted file mode 100644 index 57101ebf6d8..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-jpj8-49hr-wcwv/GHSA-jpj8-49hr-wcwv.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-jpj8-49hr-wcwv", - "modified": "2022-05-17T03:38:38Z", - "published": "2022-05-17T03:38:38Z", - "aliases": [ - "CVE-2016-9452" - ], - "details": "The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9452" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/SA-CORE-2016-005" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/94367" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2016-11-25T18:59:00Z" - } -} \ No newline at end of file