diff --git a/advisories/unreviewed/2024/01/GHSA-h57w-vh34-f8cw/GHSA-h57w-vh34-f8cw.json b/advisories/github-reviewed/2024/01/GHSA-h57w-vh34-f8cw/GHSA-h57w-vh34-f8cw.json similarity index 63% rename from advisories/unreviewed/2024/01/GHSA-h57w-vh34-f8cw/GHSA-h57w-vh34-f8cw.json rename to advisories/github-reviewed/2024/01/GHSA-h57w-vh34-f8cw/GHSA-h57w-vh34-f8cw.json index 40c5aee6551..ca550a70cec 100644 --- a/advisories/unreviewed/2024/01/GHSA-h57w-vh34-f8cw/GHSA-h57w-vh34-f8cw.json +++ b/advisories/github-reviewed/2024/01/GHSA-h57w-vh34-f8cw/GHSA-h57w-vh34-f8cw.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-h57w-vh34-f8cw", - "modified": "2024-01-23T18:31:10Z", + "modified": "2024-01-23T20:11:06Z", "published": "2024-01-16T03:30:20Z", "aliases": [ "CVE-2023-51282" ], + "summary": "Code injection in mingSoft MCMS", "details": "An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "net.mingsoft:ms-mcms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.2.4" + } + ] + } + ] + } ], "references": [ { @@ -35,8 +54,8 @@ "CWE-94" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T20:11:06Z", "nvd_published_at": "2024-01-16T02:15:28Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-rwhh-6x83-84v6/GHSA-rwhh-6x83-84v6.json b/advisories/github-reviewed/2024/01/GHSA-rwhh-6x83-84v6/GHSA-rwhh-6x83-84v6.json similarity index 75% rename from advisories/unreviewed/2024/01/GHSA-rwhh-6x83-84v6/GHSA-rwhh-6x83-84v6.json rename to advisories/github-reviewed/2024/01/GHSA-rwhh-6x83-84v6/GHSA-rwhh-6x83-84v6.json index 96135d98cff..cef7bb4e46d 100644 --- a/advisories/unreviewed/2024/01/GHSA-rwhh-6x83-84v6/GHSA-rwhh-6x83-84v6.json +++ b/advisories/github-reviewed/2024/01/GHSA-rwhh-6x83-84v6/GHSA-rwhh-6x83-84v6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rwhh-6x83-84v6", - "modified": "2024-01-23T15:30:58Z", + "modified": "2024-01-23T20:10:58Z", "published": "2024-01-23T15:30:58Z", "aliases": [ "CVE-2023-49657" ], + "summary": "Cross-site Scripting in Apache superset", "details": "A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS.\n\nFor 2.X versions, users should change their config to include:\n\nTALISMAN_CONFIG = {\n    \"content_security_policy\": {\n        \"base-uri\": [\"'self'\"],\n        \"default-src\": [\"'self'\"],\n        \"img-src\": [\"'self'\", \"blob:\", \"data:\"],\n        \"worker-src\": [\"'self'\", \"blob:\"],\n        \"connect-src\": [\n            \"'self'\",\n            \" https://api.mapbox.com\" https://api.mapbox.com\" ;,\n            \" https://events.mapbox.com\" https://events.mapbox.com\" ;,\n        ],\n        \"object-src\": \"'none'\",\n        \"style-src\": [\n            \"'self'\",\n            \"'unsafe-inline'\",\n        ],\n        \"script-src\": [\"'self'\", \"'strict-dynamic'\"],\n    },\n    \"content_security_policy_nonce_in\": [\"script-src\"],\n    \"force_https\": False,\n    \"session_cookie_secure\": False,\n}\n\n", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "apache-superset" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.0.3" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49657" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/superset" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/wjyvz8om9nwd396lh0bt156mtwjxpsvx" @@ -31,8 +54,8 @@ "CWE-79" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T20:10:58Z", "nvd_published_at": "2024-01-23T15:15:11Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-v435-pfj6-68r3/GHSA-v435-pfj6-68r3.json b/advisories/github-reviewed/2024/01/GHSA-v435-pfj6-68r3/GHSA-v435-pfj6-68r3.json similarity index 56% rename from advisories/unreviewed/2024/01/GHSA-v435-pfj6-68r3/GHSA-v435-pfj6-68r3.json rename to advisories/github-reviewed/2024/01/GHSA-v435-pfj6-68r3/GHSA-v435-pfj6-68r3.json index a7a011ab4a9..e4c52f7f7d3 100644 --- a/advisories/unreviewed/2024/01/GHSA-v435-pfj6-68r3/GHSA-v435-pfj6-68r3.json +++ b/advisories/github-reviewed/2024/01/GHSA-v435-pfj6-68r3/GHSA-v435-pfj6-68r3.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-v435-pfj6-68r3", - "modified": "2024-01-23T18:31:11Z", + "modified": "2024-01-23T20:11:19Z", "published": "2024-01-23T18:31:11Z", "aliases": [ "CVE-2024-22496" ], + "summary": "Cross-site Scripting in JFinal", "details": "Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "com.jfinal:jfinal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.0.0" + } + ] + } + ] + } ], "references": [ { @@ -25,11 +44,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T20:11:19Z", "nvd_published_at": "2024-01-23T17:15:10Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-v9wr-2xrg-v7w8/GHSA-v9wr-2xrg-v7w8.json b/advisories/github-reviewed/2024/01/GHSA-v9wr-2xrg-v7w8/GHSA-v9wr-2xrg-v7w8.json similarity index 58% rename from advisories/unreviewed/2024/01/GHSA-v9wr-2xrg-v7w8/GHSA-v9wr-2xrg-v7w8.json rename to advisories/github-reviewed/2024/01/GHSA-v9wr-2xrg-v7w8/GHSA-v9wr-2xrg-v7w8.json index 1deaffefeb5..b9f1cd47f52 100644 --- a/advisories/unreviewed/2024/01/GHSA-v9wr-2xrg-v7w8/GHSA-v9wr-2xrg-v7w8.json +++ b/advisories/github-reviewed/2024/01/GHSA-v9wr-2xrg-v7w8/GHSA-v9wr-2xrg-v7w8.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-v9wr-2xrg-v7w8", - "modified": "2024-01-23T18:31:11Z", + "modified": "2024-01-23T20:11:27Z", "published": "2024-01-23T18:31:11Z", "aliases": [ "CVE-2024-22490" ], + "summary": "Cross-site Scripting in beetl-bbs", "details": "Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the /index keyword parameter.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "com.ibeetl:beetl" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.0.0" + } + ] + } + ] + } ], "references": [ { @@ -25,11 +44,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T20:11:27Z", "nvd_published_at": "2024-01-23T17:15:10Z" } } \ No newline at end of file