diff --git a/advisories/github-reviewed/2018/07/GHSA-wh33-4p32-g7vh/GHSA-wh33-4p32-g7vh.json b/advisories/github-reviewed/2018/07/GHSA-wh33-4p32-g7vh/GHSA-wh33-4p32-g7vh.json index 6aef5eb83ad..274b5c1903c 100644 --- a/advisories/github-reviewed/2018/07/GHSA-wh33-4p32-g7vh/GHSA-wh33-4p32-g7vh.json +++ b/advisories/github-reviewed/2018/07/GHSA-wh33-4p32-g7vh/GHSA-wh33-4p32-g7vh.json @@ -1,15 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-wh33-4p32-g7vh", - "modified": "2020-08-31T18:23:48Z", + "modified": "2023-09-07T22:25:41Z", "published": "2018-07-23T20:43:56Z", "aliases": [ "CVE-2017-16182" ], "summary": "Directory Traversal in serverxxx", - "details": "Affected versions of `serverxxx` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.\n\nExample request:\n```\nGET /../../../../../../../../../../etc/passwd HTTP/1.1\nhost:foo\n```\n\n\n## Recommendation\n\nNo patch is available for this vulnerability.\n\nIt is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.", + "details": "Affected versions of `serverxxx` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.\n\n**Example request:**\n```http\nGET /../../../../../../../../../../etc/passwd HTTP/1.1\nhost:foo\n```\n\n\n## Recommendation\n\nNo patch is available for this vulnerability.\n\nIt is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ { @@ -17,6 +20,11 @@ "ecosystem": "npm", "name": "serverxxx" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", diff --git a/advisories/github-reviewed/2020/06/GHSA-mvr2-9pj6-7w5j/GHSA-mvr2-9pj6-7w5j.json b/advisories/github-reviewed/2020/06/GHSA-mvr2-9pj6-7w5j/GHSA-mvr2-9pj6-7w5j.json index 700f4f73de4..337294c38a4 100644 --- a/advisories/github-reviewed/2020/06/GHSA-mvr2-9pj6-7w5j/GHSA-mvr2-9pj6-7w5j.json +++ b/advisories/github-reviewed/2020/06/GHSA-mvr2-9pj6-7w5j/GHSA-mvr2-9pj6-7w5j.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mvr2-9pj6-7w5j", - "modified": "2021-06-09T23:19:54Z", + "modified": "2023-09-07T22:25:36Z", "published": "2020-06-15T20:35:11Z", "aliases": [ "CVE-2018-10237" @@ -20,6 +20,11 @@ "ecosystem": "Maven", "name": "com.google.guava:guava" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", @@ -33,6 +38,116 @@ ] } ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.google.guava:guava-jdk5" + }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "17.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.googlecode.guava-osgi:guava-osgi" + }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "11.0.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "de.mhus.ports:vaadin-shared-deps" + }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "7.4.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.hudsonci.lib.guava:guava" + }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "14.0.1-h-3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.sonatype.sisu:sisu-guava" + }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, + "versions": [ + "0.11.1" + ] } ], "references": [ @@ -92,6 +207,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:3149" }, + { + "type": "PACKAGE", + "url": "https://github.com/google/guava" + }, { "type": "WEB", "url": "https://github.com/google/guava/wiki/CVE-2018-10237"