diff --git a/advisories/github-reviewed/2018/09/GHSA-4wch-fwmx-cf47/GHSA-4wch-fwmx-cf47.json b/advisories/github-reviewed/2018/09/GHSA-4wch-fwmx-cf47/GHSA-4wch-fwmx-cf47.json index 643572ef445..df96f9b50e2 100644 --- a/advisories/github-reviewed/2018/09/GHSA-4wch-fwmx-cf47/GHSA-4wch-fwmx-cf47.json +++ b/advisories/github-reviewed/2018/09/GHSA-4wch-fwmx-cf47/GHSA-4wch-fwmx-cf47.json @@ -1,15 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-4wch-fwmx-cf47", - "modified": "2020-08-31T18:27:45Z", + "modified": "2023-09-08T20:55:42Z", "published": "2018-09-18T13:50:25Z", "aliases": [ "CVE-2017-0930" ], "summary": "Directory Traversal in augustine", - "details": "Affected versions of `augustine` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.\n\n## Proof of Concept\n```\nGET //etc/passwd HTTP/1.1\nhost:foo\n```\n\n\n## Recommendation\n\nNo direct patch is available at this time. \n\nCurrently, the best mitigation for this flaw is to use a different, functionally equivalent static file server package.", + "details": "Affected versions of `augustine` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.\n\n## Proof of Concept\n```http\nGET //etc/passwd HTTP/1.1\nhost:foo\n```\n\n\n## Recommendation\n\nNo direct patch is available at this time. \n\nCurrently, the best mitigation for this flaw is to use a different, functionally equivalent static file server package.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ { @@ -17,6 +20,11 @@ "ecosystem": "npm", "name": "augustine" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", @@ -54,7 +62,7 @@ "cwe_ids": [ "CWE-22" ], - "severity": "HIGH", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2020-06-16T20:59:26Z", "nvd_published_at": null diff --git a/advisories/github-reviewed/2018/10/GHSA-6g33-f262-xjp4/GHSA-6g33-f262-xjp4.json b/advisories/github-reviewed/2018/10/GHSA-6g33-f262-xjp4/GHSA-6g33-f262-xjp4.json index 39b78fcb3ca..bb3433585ce 100644 --- a/advisories/github-reviewed/2018/10/GHSA-6g33-f262-xjp4/GHSA-6g33-f262-xjp4.json +++ b/advisories/github-reviewed/2018/10/GHSA-6g33-f262-xjp4/GHSA-6g33-f262-xjp4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6g33-f262-xjp4", - "modified": "2021-01-08T20:58:33Z", + "modified": "2023-09-08T20:56:26Z", "published": "2018-10-09T00:57:21Z", "aliases": [ "CVE-2017-16028" @@ -9,7 +9,10 @@ "summary": "Cryptographically Weak PRNG in randomatic", "details": "Affected versions of `randomatic` generate random values using a cryptographically weak psuedo-random number generator. This may result in predictable values instead of random values as intended.\n\n\n\n\n## Recommendation\n\nUpdate to version 3.0.0 or later.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ { @@ -17,6 +20,11 @@ "ecosystem": "npm", "name": "randomatic" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", @@ -56,9 +64,10 @@ ], "database_specific": { "cwe_ids": [ - "CWE-330" + "CWE-330", + "CWE-338" ], - "severity": "LOW", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2020-06-16T21:19:13Z", "nvd_published_at": null