Publish Advisories

GHSA-9295-mhf3-v33m
GHSA-8qpm-5c82-rf96
GHSA-hmhg-95wh-r699

advisories/github-reviewed/2021/03/GHSA-9295-mhf3-v33m/GHSA-9295-mhf3-v33m.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9295-mhf3-v33m",
-  "modified": "2021-03-29T18:25:13Z",
+  "modified": "2023-08-08T19:54:40Z",
   "published": "2021-03-29T18:25:26Z",
   "aliases": [
     "CVE-2021-28099"
@@ -9,7 +9,10 @@
   "summary": "Insecure temporary file in Netflix OSS Hollow",
   "details": "> ID: NFLX-2021-001\n> Title: Local information disclosure in Hollow\n> Release Date: 2021-03-23\n> Credit: Security Researcher @JLLeitschuh\n\n# Overview\n\nSecurity researcher @JLLeitschuh reported that Netflix Hollow (a Netflix OSS project available here: https://github.com/Netflix/hollow) writes to a local temporary directory before validating the permissions on it.\n\n# Impact\n\nAn attacker with the ability to create directories and set permissions on the local filesystem could pre-create this directory and read or modify anything written there by the Hollow process.\n\n# Description\n\nSince the `Files.exists(parent)` is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.\n\n# Workarounds and Fixes\n\nAvoid running Hollow in configurations that share a filesystem with less-trusted processes. May be fixed in a future release.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
+    }
   ],
   "affected": [
     {

advisories/github-reviewed/2021/05/GHSA-8qpm-5c82-rf96/GHSA-8qpm-5c82-rf96.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8qpm-5c82-rf96",
-  "modified": "2021-04-26T19:07:16Z",
+  "modified": "2023-08-08T19:54:27Z",
   "published": "2021-05-06T15:52:02Z",
   "aliases": [
     "CVE-2021-20085"
@@ -9,7 +9,10 @@
   "summary": "Prototype Pollution in backbone-query-parameters",
   "details": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicious user to inject properties into Object.prototype.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
     {

advisories/github-reviewed/2022/05/GHSA-hmhg-95wh-r699/GHSA-hmhg-95wh-r699.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hmhg-95wh-r699",
-  "modified": "2023-05-31T18:25:53Z",
+  "modified": "2023-08-08T19:55:12Z",
   "published": "2022-05-24T19:03:11Z",
   "aliases": [
     "CVE-2021-23937"
@@ -9,7 +9,10 @@
   "summary": "DNS based denial of service in Apache Wicket",
   "details": "A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to overload an internal DNS server or to slow down request processing of the Apache Wicket application causing a possible denial of service on either the internal infrastructure or the web application itself. This issue affects Apache Wicket Apache Wicket 9.x version 9.2.0 and prior versions; Apache Wicket 8.x version 8.11.0 and prior versions; Apache Wicket 7.x version 7.17.0 and prior versions and Apache Wicket 6.x version 6.2.0 and later versions.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
     {