diff --git a/advisories/unreviewed/2022/05/GHSA-4hf3-229w-6h8r/GHSA-4hf3-229w-6h8r.json b/advisories/github-reviewed/2022/05/GHSA-4hf3-229w-6h8r/GHSA-4hf3-229w-6h8r.json similarity index 78% rename from advisories/unreviewed/2022/05/GHSA-4hf3-229w-6h8r/GHSA-4hf3-229w-6h8r.json rename to advisories/github-reviewed/2022/05/GHSA-4hf3-229w-6h8r/GHSA-4hf3-229w-6h8r.json index e7cd9bbf3bd..eed299facef 100644 --- a/advisories/unreviewed/2022/05/GHSA-4hf3-229w-6h8r/GHSA-4hf3-229w-6h8r.json +++ b/advisories/github-reviewed/2022/05/GHSA-4hf3-229w-6h8r/GHSA-4hf3-229w-6h8r.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-4hf3-229w-6h8r", - "modified": "2022-11-17T18:30:30Z", + "modified": "2024-04-24T20:39:13Z", "published": "2022-05-24T17:07:29Z", "aliases": [ "CVE-2020-7994" ], + "summary": "Dolibarr cross-site scripting (XSS) vulnerability", "details": "Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) name[constname] parameter to the /htdocs/admin/const.php?mainmenu=home page; the (3) note[note] parameter to the /htdocs/admin/dict.php?id=10 page; the (4) zip[MAIN_INFO_SOCIETE_ZIP] or email[mail] parameter to the /htdocs/admin/company.php page; the (5) url[defaulturl], field[defaultkey], or value[defaultvalue] parameter to the /htdocs/admin/defaultvalues.php page; the (6) key[transkey] or key[transvalue] parameter to the /htdocs/admin/translation.php page; or the (7) [main_motd] or [main_home] parameter to the /htdocs/admin/ihm.php page.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "10.0.6" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7994" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://github.com/tufangungor/tufangungor.github.io/blob/master/0days.md" @@ -35,8 +48,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:39:13Z", "nvd_published_at": "2020-01-26T23:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-4qq9-qg7j-fcm9/GHSA-4qq9-qg7j-fcm9.json b/advisories/github-reviewed/2022/05/GHSA-4qq9-qg7j-fcm9/GHSA-4qq9-qg7j-fcm9.json new file mode 100644 index 00000000000..5d4f14439dc --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-4qq9-qg7j-fcm9/GHSA-4qq9-qg7j-fcm9.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4qq9-qg7j-fcm9", + "modified": "2024-04-24T20:40:10Z", + "published": "2022-05-24T16:53:44Z", + "aliases": [ + "CVE-2019-15062" + ], + "summary": "Dolibarr Cross-Site Request Forgery (CSRF) ", + "details": "An issue was discovered in Dolibarr. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.0" + }, + { + "fixed": "10.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15062" + }, + { + "type": "WEB", + "url": "https://github.com/Dolibarr/dolibarr/issues/11671" + }, + { + "type": "WEB", + "url": "https://github.com/Dolibarr/dolibarr/commit/18eb2a83fe7c2d01bdb34cceec389a6f9541e1f6" + }, + { + "type": "WEB", + "url": "https://github.com/Dolibarr/dolibarr/commit/d21e5571007d2052a6b5f80a67b6f4cac693584a" + }, + { + "type": "WEB", + "url": "https://gauravnarwani.com/publications/CVE-2019-15062" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:40:10Z", + "nvd_published_at": "2019-08-14T23:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-726g-cgcq-4xw8/GHSA-726g-cgcq-4xw8.json b/advisories/github-reviewed/2022/05/GHSA-726g-cgcq-4xw8/GHSA-726g-cgcq-4xw8.json similarity index 63% rename from advisories/unreviewed/2022/05/GHSA-726g-cgcq-4xw8/GHSA-726g-cgcq-4xw8.json rename to advisories/github-reviewed/2022/05/GHSA-726g-cgcq-4xw8/GHSA-726g-cgcq-4xw8.json index aadc5565848..1adcb7ee5c5 100644 --- a/advisories/unreviewed/2022/05/GHSA-726g-cgcq-4xw8/GHSA-726g-cgcq-4xw8.json +++ b/advisories/github-reviewed/2022/05/GHSA-726g-cgcq-4xw8/GHSA-726g-cgcq-4xw8.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-726g-cgcq-4xw8", - "modified": "2022-05-14T03:23:30Z", + "modified": "2024-04-24T20:40:25Z", "published": "2022-05-14T03:23:30Z", "aliases": [ "CVE-2017-9838" ], + "summary": "Dolibarr Cross-Site Scripting (XSS) vulnerability", "details": "Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and month_end parameters), and don/card.php (societe, lastname, firstname, address, zipcode, town, and email parameters).", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.0.4" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9838" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-008" @@ -31,8 +54,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:40:25Z", "nvd_published_at": "2018-04-11T03:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-84gh-4m36-cgqx/GHSA-84gh-4m36-cgqx.json b/advisories/github-reviewed/2022/05/GHSA-84gh-4m36-cgqx/GHSA-84gh-4m36-cgqx.json similarity index 55% rename from advisories/unreviewed/2022/05/GHSA-84gh-4m36-cgqx/GHSA-84gh-4m36-cgqx.json rename to advisories/github-reviewed/2022/05/GHSA-84gh-4m36-cgqx/GHSA-84gh-4m36-cgqx.json index 9e93b652f64..20cd640f428 100644 --- a/advisories/unreviewed/2022/05/GHSA-84gh-4m36-cgqx/GHSA-84gh-4m36-cgqx.json +++ b/advisories/github-reviewed/2022/05/GHSA-84gh-4m36-cgqx/GHSA-84gh-4m36-cgqx.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-84gh-4m36-cgqx", - "modified": "2022-05-14T03:23:30Z", + "modified": "2024-04-24T20:40:30Z", "published": "2022-05-14T03:23:30Z", "aliases": [ "CVE-2017-9839" ], + "summary": "Dolibarr SQL injection via type parameter in product/stats/card.php", "details": "Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter).", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.0.4" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9839" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-010" @@ -31,8 +54,8 @@ "CWE-89" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:40:30Z", "nvd_published_at": "2018-04-11T03:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-9h46-g4c9-7976/GHSA-9h46-g4c9-7976.json b/advisories/github-reviewed/2022/05/GHSA-9h46-g4c9-7976/GHSA-9h46-g4c9-7976.json similarity index 64% rename from advisories/unreviewed/2022/05/GHSA-9h46-g4c9-7976/GHSA-9h46-g4c9-7976.json rename to advisories/github-reviewed/2022/05/GHSA-9h46-g4c9-7976/GHSA-9h46-g4c9-7976.json index 29c8f2cb488..156b8600063 100644 --- a/advisories/unreviewed/2022/05/GHSA-9h46-g4c9-7976/GHSA-9h46-g4c9-7976.json +++ b/advisories/github-reviewed/2022/05/GHSA-9h46-g4c9-7976/GHSA-9h46-g4c9-7976.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-9h46-g4c9-7976", - "modified": "2022-11-17T18:30:29Z", + "modified": "2024-04-24T20:39:27Z", "published": "2022-05-24T16:57:07Z", "aliases": [ "CVE-2019-16688" ], + "summary": "Dolibarr stored Cross-site Scripting in an Email Template section", "details": "Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to users with no permissions.)", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "9.0.5" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16688" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "http://verneet.com/cve-2019-16688" @@ -30,9 +43,9 @@ "cwe_ids": [ "CWE-79" ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:39:27Z", "nvd_published_at": "2019-09-27T20:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-fvxr-767j-f28v/GHSA-fvxr-767j-f28v.json b/advisories/github-reviewed/2022/05/GHSA-fvxr-767j-f28v/GHSA-fvxr-767j-f28v.json similarity index 67% rename from advisories/unreviewed/2022/05/GHSA-fvxr-767j-f28v/GHSA-fvxr-767j-f28v.json rename to advisories/github-reviewed/2022/05/GHSA-fvxr-767j-f28v/GHSA-fvxr-767j-f28v.json index 14d481e45d3..da7f13eacce 100644 --- a/advisories/unreviewed/2022/05/GHSA-fvxr-767j-f28v/GHSA-fvxr-767j-f28v.json +++ b/advisories/github-reviewed/2022/05/GHSA-fvxr-767j-f28v/GHSA-fvxr-767j-f28v.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fvxr-767j-f28v", - "modified": "2022-11-17T18:30:29Z", + "modified": "2024-04-24T20:39:37Z", "published": "2022-05-24T16:57:07Z", "aliases": [ "CVE-2019-16685" ], + "summary": "Dolibarr stored Cross-site Scripting vulnerability", "details": "Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the \"Create/modify other users, groups and permissions\" privilege can inject script and can also achieve privilege escalation.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "9.0.5" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16685" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "http://verneet.com/cve-2019-16685" @@ -31,8 +44,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:39:37Z", "nvd_published_at": "2019-09-27T20:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-m44p-cfwj-wwr6/GHSA-m44p-cfwj-wwr6.json b/advisories/github-reviewed/2022/05/GHSA-m44p-cfwj-wwr6/GHSA-m44p-cfwj-wwr6.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-m44p-cfwj-wwr6/GHSA-m44p-cfwj-wwr6.json rename to advisories/github-reviewed/2022/05/GHSA-m44p-cfwj-wwr6/GHSA-m44p-cfwj-wwr6.json index 33c58cd4389..b1be48d894f 100644 --- a/advisories/unreviewed/2022/05/GHSA-m44p-cfwj-wwr6/GHSA-m44p-cfwj-wwr6.json +++ b/advisories/github-reviewed/2022/05/GHSA-m44p-cfwj-wwr6/GHSA-m44p-cfwj-wwr6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-m44p-cfwj-wwr6", - "modified": "2022-11-17T18:30:29Z", + "modified": "2024-04-24T20:39:34Z", "published": "2022-05-24T16:57:07Z", "aliases": [ "CVE-2019-16686" ], + "summary": "Dolibarr Cross-site Scripting in a User Note section", "details": "Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the admin.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "9.0.5" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16686" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "http://verneet.com/cve-2019-16686" @@ -30,9 +43,9 @@ "cwe_ids": [ "CWE-79" ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:39:33Z", "nvd_published_at": "2019-09-27T20:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-m5c3-3gvf-q8j5/GHSA-m5c3-3gvf-q8j5.json b/advisories/github-reviewed/2022/05/GHSA-m5c3-3gvf-q8j5/GHSA-m5c3-3gvf-q8j5.json similarity index 70% rename from advisories/unreviewed/2022/05/GHSA-m5c3-3gvf-q8j5/GHSA-m5c3-3gvf-q8j5.json rename to advisories/github-reviewed/2022/05/GHSA-m5c3-3gvf-q8j5/GHSA-m5c3-3gvf-q8j5.json index 1b8e16c8d88..9ca1858b6fa 100644 --- a/advisories/unreviewed/2022/05/GHSA-m5c3-3gvf-q8j5/GHSA-m5c3-3gvf-q8j5.json +++ b/advisories/github-reviewed/2022/05/GHSA-m5c3-3gvf-q8j5/GHSA-m5c3-3gvf-q8j5.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-m5c3-3gvf-q8j5", - "modified": "2022-05-24T17:07:30Z", + "modified": "2024-04-24T20:40:17Z", "published": "2022-05-24T17:07:30Z", "aliases": [ "CVE-2020-7995" ], + "summary": "Dolibarr Improper Restriction of Excessive Authentication Attempts", "details": "The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "10.0.6" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7995" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://github.com/tufangungor/tufangungor.github.io/blob/master/_posts/2020-01-19-dolibarr-10.0.6-brute-force.md" @@ -39,9 +52,9 @@ "CWE-287", "CWE-307" ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:40:17Z", "nvd_published_at": "2020-01-26T23:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-m9q9-4m25-23gc/GHSA-m9q9-4m25-23gc.json b/advisories/github-reviewed/2022/05/GHSA-m9q9-4m25-23gc/GHSA-m9q9-4m25-23gc.json similarity index 64% rename from advisories/unreviewed/2022/05/GHSA-m9q9-4m25-23gc/GHSA-m9q9-4m25-23gc.json rename to advisories/github-reviewed/2022/05/GHSA-m9q9-4m25-23gc/GHSA-m9q9-4m25-23gc.json index 7bbee61ba6d..f2b28cc3ada 100644 --- a/advisories/unreviewed/2022/05/GHSA-m9q9-4m25-23gc/GHSA-m9q9-4m25-23gc.json +++ b/advisories/github-reviewed/2022/05/GHSA-m9q9-4m25-23gc/GHSA-m9q9-4m25-23gc.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-m9q9-4m25-23gc", - "modified": "2022-11-17T18:30:29Z", + "modified": "2024-04-24T20:39:30Z", "published": "2022-05-24T16:57:07Z", "aliases": [ "CVE-2019-16687" ], + "summary": "Dolibarr Cross-site Scripting in a User Profile in a Signature section", "details": "Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the \"Create/modify other users, groups and permissions\" privilege can inject script and can also achieve privilege escalation.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "9.0.5" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16687" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "http://verneet.com/cve-2019-16687" @@ -30,9 +43,9 @@ "cwe_ids": [ "CWE-79" ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:39:30Z", "nvd_published_at": "2019-09-27T20:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-p2fm-8rhj-58fr/GHSA-p2fm-8rhj-58fr.json b/advisories/github-reviewed/2022/05/GHSA-p2fm-8rhj-58fr/GHSA-p2fm-8rhj-58fr.json similarity index 66% rename from advisories/unreviewed/2022/05/GHSA-p2fm-8rhj-58fr/GHSA-p2fm-8rhj-58fr.json rename to advisories/github-reviewed/2022/05/GHSA-p2fm-8rhj-58fr/GHSA-p2fm-8rhj-58fr.json index bd5f0e7fc2b..81d8b9b5f6d 100644 --- a/advisories/unreviewed/2022/05/GHSA-p2fm-8rhj-58fr/GHSA-p2fm-8rhj-58fr.json +++ b/advisories/github-reviewed/2022/05/GHSA-p2fm-8rhj-58fr/GHSA-p2fm-8rhj-58fr.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-p2fm-8rhj-58fr", - "modified": "2022-05-14T03:20:23Z", + "modified": "2024-04-24T20:40:21Z", "published": "2022-05-14T03:20:23Z", "aliases": [ "CVE-2018-10095" ], + "summary": "Dolibarr Cross-site scripting (XSS) vulnerability", "details": "Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.0.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/commit/1dc466e1fb687cfe647de4af891720419823ed56" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog" @@ -43,8 +66,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:40:21Z", "nvd_published_at": "2018-05-22T20:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-pm57-926c-28mr/GHSA-pm57-926c-28mr.json b/advisories/github-reviewed/2022/05/GHSA-pm57-926c-28mr/GHSA-pm57-926c-28mr.json similarity index 51% rename from advisories/unreviewed/2022/05/GHSA-pm57-926c-28mr/GHSA-pm57-926c-28mr.json rename to advisories/github-reviewed/2022/05/GHSA-pm57-926c-28mr/GHSA-pm57-926c-28mr.json index 3fb78ac4004..53c44c0e215 100644 --- a/advisories/unreviewed/2022/05/GHSA-pm57-926c-28mr/GHSA-pm57-926c-28mr.json +++ b/advisories/github-reviewed/2022/05/GHSA-pm57-926c-28mr/GHSA-pm57-926c-28mr.json @@ -1,23 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-pm57-926c-28mr", - "modified": "2022-05-24T17:11:33Z", + "modified": "2024-04-24T20:38:55Z", "published": "2022-05-24T17:11:33Z", "aliases": [ "CVE-2019-19212" ], + "summary": "Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php", "details": "Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0" + }, + { + "last_affected": "10.0.3" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19212" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://herolab.usd.de/en/security-advisories" @@ -33,11 +59,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:38:55Z", "nvd_published_at": "2020-03-16T20:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-r4gf-ggp5-25g5/GHSA-r4gf-ggp5-25g5.json b/advisories/github-reviewed/2022/05/GHSA-r4gf-ggp5-25g5/GHSA-r4gf-ggp5-25g5.json similarity index 66% rename from advisories/unreviewed/2022/05/GHSA-r4gf-ggp5-25g5/GHSA-r4gf-ggp5-25g5.json rename to advisories/github-reviewed/2022/05/GHSA-r4gf-ggp5-25g5/GHSA-r4gf-ggp5-25g5.json index 7314574298d..a08dec548aa 100644 --- a/advisories/unreviewed/2022/05/GHSA-r4gf-ggp5-25g5/GHSA-r4gf-ggp5-25g5.json +++ b/advisories/github-reviewed/2022/05/GHSA-r4gf-ggp5-25g5/GHSA-r4gf-ggp5-25g5.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-r4gf-ggp5-25g5", - "modified": "2022-11-17T18:30:29Z", + "modified": "2024-04-24T20:39:23Z", "published": "2022-05-24T16:58:57Z", "aliases": [ "CVE-2019-17577" ], + "summary": "Dolibarr Cross-site Scripting via outgoing email setup feature", "details": "An issue was discovered in Dolibarr 10.0.2. It has XSS via the \"outgoing email setup\" feature in the admin/mails.php?action=edit URI via the \"Email used for error returns emails (fields 'Errors-To' in emails sent)\" field.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "10.0.2" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17577" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://mycvee.blogspot.com/p/cve-2019-17576.html" @@ -31,8 +44,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:39:23Z", "nvd_published_at": "2019-10-16T18:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-rr5g-rc28-wxwj/GHSA-rr5g-rc28-wxwj.json b/advisories/github-reviewed/2022/05/GHSA-rr5g-rc28-wxwj/GHSA-rr5g-rc28-wxwj.json similarity index 66% rename from advisories/unreviewed/2022/05/GHSA-rr5g-rc28-wxwj/GHSA-rr5g-rc28-wxwj.json rename to advisories/github-reviewed/2022/05/GHSA-rr5g-rc28-wxwj/GHSA-rr5g-rc28-wxwj.json index b1a30f2a71f..247f91b8e6f 100644 --- a/advisories/unreviewed/2022/05/GHSA-rr5g-rc28-wxwj/GHSA-rr5g-rc28-wxwj.json +++ b/advisories/github-reviewed/2022/05/GHSA-rr5g-rc28-wxwj/GHSA-rr5g-rc28-wxwj.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rr5g-rc28-wxwj", - "modified": "2022-11-17T18:30:29Z", + "modified": "2024-04-24T20:39:20Z", "published": "2022-05-24T16:58:57Z", "aliases": [ "CVE-2019-17576" ], + "summary": "Dolibarr Cross-site Scripting via outgoing email setup feature", "details": "An issue was discovered in Dolibarr 10.0.2. It has XSS via the \"outgoing email setup\" feature in the /admin/mails.php?action=edit URI via the \"Send all emails to (instead of real recipients, for test purposes)\" field.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "10.0.2" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17576" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://mycvee.blogspot.com/p/blog-page.html" @@ -31,8 +44,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-24T20:39:20Z", "nvd_published_at": "2019-10-16T18:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-4qq9-qg7j-fcm9/GHSA-4qq9-qg7j-fcm9.json b/advisories/unreviewed/2022/05/GHSA-4qq9-qg7j-fcm9/GHSA-4qq9-qg7j-fcm9.json deleted file mode 100644 index c20fb6a755b..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-4qq9-qg7j-fcm9/GHSA-4qq9-qg7j-fcm9.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-4qq9-qg7j-fcm9", - "modified": "2022-11-17T18:30:28Z", - "published": "2022-05-24T16:53:44Z", - "aliases": [ - "CVE-2019-15062" - ], - "details": "An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.)", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15062" - }, - { - "type": "WEB", - "url": "https://github.com/Dolibarr/dolibarr/issues/11671" - }, - { - "type": "WEB", - "url": "https://gauravnarwani.com/publications/CVE-2019-15062" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-08-14T23:15:00Z" - } -} \ No newline at end of file