diff --git a/advisories/github-reviewed/2021/03/GHSA-9295-mhf3-v33m/GHSA-9295-mhf3-v33m.json b/advisories/github-reviewed/2021/03/GHSA-9295-mhf3-v33m/GHSA-9295-mhf3-v33m.json index e887db37900..f50eee4bcff 100644 --- a/advisories/github-reviewed/2021/03/GHSA-9295-mhf3-v33m/GHSA-9295-mhf3-v33m.json +++ b/advisories/github-reviewed/2021/03/GHSA-9295-mhf3-v33m/GHSA-9295-mhf3-v33m.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9295-mhf3-v33m", - "modified": "2021-03-29T18:25:13Z", + "modified": "2023-08-08T19:54:40Z", "published": "2021-03-29T18:25:26Z", "aliases": [ "CVE-2021-28099" @@ -9,7 +9,10 @@ "summary": "Insecure temporary file in Netflix OSS Hollow", "details": "> ID: NFLX-2021-001\n> Title: Local information disclosure in Hollow\n> Release Date: 2021-03-23\n> Credit: Security Researcher @JLLeitschuh\n\n# Overview\n\nSecurity researcher @JLLeitschuh reported that Netflix Hollow (a Netflix OSS project available here: https://github.com/Netflix/hollow) writes to a local temporary directory before validating the permissions on it.\n\n# Impact\n\nAn attacker with the ability to create directories and set permissions on the local filesystem could pre-create this directory and read or modify anything written there by the Hollow process.\n\n# Description\n\nSince the `Files.exists(parent)` is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.\n\n# Workarounds and Fixes\n\nAvoid running Hollow in configurations that share a filesystem with less-trusted processes. May be fixed in a future release.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } ], "affected": [ { diff --git a/advisories/github-reviewed/2021/05/GHSA-8qpm-5c82-rf96/GHSA-8qpm-5c82-rf96.json b/advisories/github-reviewed/2021/05/GHSA-8qpm-5c82-rf96/GHSA-8qpm-5c82-rf96.json index 5f5fbc5de03..97526bbf9a4 100644 --- a/advisories/github-reviewed/2021/05/GHSA-8qpm-5c82-rf96/GHSA-8qpm-5c82-rf96.json +++ b/advisories/github-reviewed/2021/05/GHSA-8qpm-5c82-rf96/GHSA-8qpm-5c82-rf96.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8qpm-5c82-rf96", - "modified": "2021-04-26T19:07:16Z", + "modified": "2023-08-08T19:54:27Z", "published": "2021-05-06T15:52:02Z", "aliases": [ "CVE-2021-20085" @@ -9,7 +9,10 @@ "summary": "Prototype Pollution in backbone-query-parameters", "details": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicious user to inject properties into Object.prototype.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ { diff --git a/advisories/github-reviewed/2022/05/GHSA-hmhg-95wh-r699/GHSA-hmhg-95wh-r699.json b/advisories/github-reviewed/2022/05/GHSA-hmhg-95wh-r699/GHSA-hmhg-95wh-r699.json index c1067d890ed..8e42e76e3ce 100644 --- a/advisories/github-reviewed/2022/05/GHSA-hmhg-95wh-r699/GHSA-hmhg-95wh-r699.json +++ b/advisories/github-reviewed/2022/05/GHSA-hmhg-95wh-r699/GHSA-hmhg-95wh-r699.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hmhg-95wh-r699", - "modified": "2023-05-31T18:25:53Z", + "modified": "2023-08-08T19:55:12Z", "published": "2022-05-24T19:03:11Z", "aliases": [ "CVE-2021-23937" @@ -9,7 +9,10 @@ "summary": "DNS based denial of service in Apache Wicket", "details": "A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to overload an internal DNS server or to slow down request processing of the Apache Wicket application causing a possible denial of service on either the internal infrastructure or the web application itself. This issue affects Apache Wicket Apache Wicket 9.x version 9.2.0 and prior versions; Apache Wicket 8.x version 8.11.0 and prior versions; Apache Wicket 7.x version 7.17.0 and prior versions and Apache Wicket 6.x version 6.2.0 and later versions.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ {