diff --git a/advisories/github-reviewed/2017/10/GHSA-75w6-p6mg-vh8j/GHSA-75w6-p6mg-vh8j.json b/advisories/github-reviewed/2017/10/GHSA-75w6-p6mg-vh8j/GHSA-75w6-p6mg-vh8j.json index 269861dc296..e7c6a89abcd 100644 --- a/advisories/github-reviewed/2017/10/GHSA-75w6-p6mg-vh8j/GHSA-75w6-p6mg-vh8j.json +++ b/advisories/github-reviewed/2017/10/GHSA-75w6-p6mg-vh8j/GHSA-75w6-p6mg-vh8j.json @@ -8,9 +8,7 @@ ], "summary": "Rails actionpack gem vulnerable to Cross-site Scripting", "details": "Multiple cross-site scripting (XSS) vulnerabilities in the `mail_to` helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2017/10/GHSA-fg9w-g6m4-557j/GHSA-fg9w-g6m4-557j.json b/advisories/github-reviewed/2017/10/GHSA-fg9w-g6m4-557j/GHSA-fg9w-g6m4-557j.json index 373694a258d..e39e52838b6 100644 --- a/advisories/github-reviewed/2017/10/GHSA-fg9w-g6m4-557j/GHSA-fg9w-g6m4-557j.json +++ b/advisories/github-reviewed/2017/10/GHSA-fg9w-g6m4-557j/GHSA-fg9w-g6m4-557j.json @@ -8,9 +8,7 @@ ], "summary": "actionpack and activesupport vulnerable to information leaks", "details": "A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2017/10/GHSA-wwmf-6p58-6vj2/GHSA-wwmf-6p58-6vj2.json b/advisories/github-reviewed/2017/10/GHSA-wwmf-6p58-6vj2/GHSA-wwmf-6p58-6vj2.json index b27eea4e4bd..62d06c8faf5 100644 --- a/advisories/github-reviewed/2017/10/GHSA-wwmf-6p58-6vj2/GHSA-wwmf-6p58-6vj2.json +++ b/advisories/github-reviewed/2017/10/GHSA-wwmf-6p58-6vj2/GHSA-wwmf-6p58-6vj2.json @@ -8,9 +8,7 @@ ], "summary": "Remote code execution in rwiki", "details": "The editing form in RWiki 2.1.0pre1 through 2.1.0 allows remote attackers to execute arbitrary Ruby code via unknown attack vectors.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { @@ -63,9 +61,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-06-16T22:01:28Z", diff --git a/advisories/github-reviewed/2019/02/GHSA-2mhh-w6q8-5hxw/GHSA-2mhh-w6q8-5hxw.json b/advisories/github-reviewed/2019/02/GHSA-2mhh-w6q8-5hxw/GHSA-2mhh-w6q8-5hxw.json index 1aaff3238f6..f4e55d3d550 100644 --- a/advisories/github-reviewed/2019/02/GHSA-2mhh-w6q8-5hxw/GHSA-2mhh-w6q8-5hxw.json +++ b/advisories/github-reviewed/2019/02/GHSA-2mhh-w6q8-5hxw/GHSA-2mhh-w6q8-5hxw.json @@ -8,9 +8,7 @@ ], "summary": "Remote Memory Disclosure in ws", "details": "Versions of `ws` prior to 1.0.1 are affected by a remote memory disclosure vulnerability.\n\nIn certain rare circumstances, applications which allow users to control the arguments of a `client.ping()` call will cause `ws` to send the contents of an allocated but non-zero-filled buffer to the server. This may disclose sensitive information that still exists in memory after previous use of the memory for other tasks.\n\n\n\n## Proof of Concept\n```\nvar ws = require('ws')\n\nvar server = new ws.Server({ port: 9000 })\nvar client = new ws('ws://localhost:9000')\n\nclient.on('open', function () {\n console.log('open')\n client.ping(50) // this sends a non-zeroed buffer of 50 bytes\n\n client.on('pong', function (data) {\n console.log('got pong')\n console.log(data) // Data from the client. \n })\n})\n```\n\n\n## Recommendation\n\nUpdate to version 1.0.1 or greater.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2020/06/GHSA-6hgm-866r-3cjv/GHSA-6hgm-866r-3cjv.json b/advisories/github-reviewed/2020/06/GHSA-6hgm-866r-3cjv/GHSA-6hgm-866r-3cjv.json index a43925ffe21..b5ee7bff879 100644 --- a/advisories/github-reviewed/2020/06/GHSA-6hgm-866r-3cjv/GHSA-6hgm-866r-3cjv.json +++ b/advisories/github-reviewed/2020/06/GHSA-6hgm-866r-3cjv/GHSA-6hgm-866r-3cjv.json @@ -8,9 +8,7 @@ ], "summary": "Insecure Deserialization in Apache Commons Collection", "details": "Serialized-object interfaces in Java applications using the Apache Commons Collections (ACC) library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-2rvf-329f-p99g/GHSA-2rvf-329f-p99g.json b/advisories/github-reviewed/2022/05/GHSA-2rvf-329f-p99g/GHSA-2rvf-329f-p99g.json index f9b9120b556..ad9bfce9663 100644 --- a/advisories/github-reviewed/2022/05/GHSA-2rvf-329f-p99g/GHSA-2rvf-329f-p99g.json +++ b/advisories/github-reviewed/2022/05/GHSA-2rvf-329f-p99g/GHSA-2rvf-329f-p99g.json @@ -301,9 +301,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2022-06-02T21:05:25Z", diff --git a/advisories/github-reviewed/2022/05/GHSA-3mjp-p938-4329/GHSA-3mjp-p938-4329.json b/advisories/github-reviewed/2022/05/GHSA-3mjp-p938-4329/GHSA-3mjp-p938-4329.json index bbd23764d56..d1967bb601c 100644 --- a/advisories/github-reviewed/2022/05/GHSA-3mjp-p938-4329/GHSA-3mjp-p938-4329.json +++ b/advisories/github-reviewed/2022/05/GHSA-3mjp-p938-4329/GHSA-3mjp-p938-4329.json @@ -337,9 +337,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-12-08T21:59:22Z", diff --git a/advisories/github-reviewed/2022/05/GHSA-6fxm-66hq-fc96/GHSA-6fxm-66hq-fc96.json b/advisories/github-reviewed/2022/05/GHSA-6fxm-66hq-fc96/GHSA-6fxm-66hq-fc96.json index 741f8928be9..3ea32f9d9e5 100644 --- a/advisories/github-reviewed/2022/05/GHSA-6fxm-66hq-fc96/GHSA-6fxm-66hq-fc96.json +++ b/advisories/github-reviewed/2022/05/GHSA-6fxm-66hq-fc96/GHSA-6fxm-66hq-fc96.json @@ -8,9 +8,7 @@ ], "summary": "Uncontrolled Resource Consumption in Apache Commons Compress", "details": "Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-f7w7-6pjc-wwm6/GHSA-f7w7-6pjc-wwm6.json b/advisories/github-reviewed/2022/05/GHSA-f7w7-6pjc-wwm6/GHSA-f7w7-6pjc-wwm6.json index fa121f804d3..e19efe0809a 100644 --- a/advisories/github-reviewed/2022/05/GHSA-f7w7-6pjc-wwm6/GHSA-f7w7-6pjc-wwm6.json +++ b/advisories/github-reviewed/2022/05/GHSA-f7w7-6pjc-wwm6/GHSA-f7w7-6pjc-wwm6.json @@ -8,9 +8,7 @@ ], "summary": "Apache Tomcat affected by vulnerability in TLS and SSL protocol", "details": "The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a \"plaintext injection\" attack, aka the \"Project Mogul\" issue.\n\nApache Tomcat was affected by this issue and introduced a workaround in versions 7.0.10, 6.0.32, and 5.5.33.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-qqgj-22gr-73vx/GHSA-qqgj-22gr-73vx.json b/advisories/github-reviewed/2022/05/GHSA-qqgj-22gr-73vx/GHSA-qqgj-22gr-73vx.json index 8ef0d34da6a..70b254ca28c 100644 --- a/advisories/github-reviewed/2022/05/GHSA-qqgj-22gr-73vx/GHSA-qqgj-22gr-73vx.json +++ b/advisories/github-reviewed/2022/05/GHSA-qqgj-22gr-73vx/GHSA-qqgj-22gr-73vx.json @@ -103,9 +103,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-04-29T16:52:01Z", diff --git a/advisories/github-reviewed/2022/12/GHSA-q7jc-v6f2-q9jr/GHSA-q7jc-v6f2-q9jr.json b/advisories/github-reviewed/2022/12/GHSA-q7jc-v6f2-q9jr/GHSA-q7jc-v6f2-q9jr.json index 2fe5b470182..9e1d3570245 100644 --- a/advisories/github-reviewed/2022/12/GHSA-q7jc-v6f2-q9jr/GHSA-q7jc-v6f2-q9jr.json +++ b/advisories/github-reviewed/2022/12/GHSA-q7jc-v6f2-q9jr/GHSA-q7jc-v6f2-q9jr.json @@ -4,9 +4,7 @@ "modified": "2023-12-20T18:21:37Z", "published": "2022-12-13T15:30:26Z", "withdrawn": "2023-12-18T19:30:26Z", - "aliases": [ - - ], + "aliases": [], "summary": "Duplicate Advisory: Resque Scheduler Reflected XSS In Delayed Jobs View", "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-9hmq-fm33-x4xx. This link is maintained to preserve external references.\n\n## Original Description\nResque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the \"{schedule_job}\" or \"args\" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.", "severity": [ diff --git a/advisories/github-reviewed/2023/01/GHSA-7vcx-v65q-9wpg/GHSA-7vcx-v65q-9wpg.json b/advisories/github-reviewed/2023/01/GHSA-7vcx-v65q-9wpg/GHSA-7vcx-v65q-9wpg.json index 281b561050d..aa84bc69556 100644 --- a/advisories/github-reviewed/2023/01/GHSA-7vcx-v65q-9wpg/GHSA-7vcx-v65q-9wpg.json +++ b/advisories/github-reviewed/2023/01/GHSA-7vcx-v65q-9wpg/GHSA-7vcx-v65q-9wpg.json @@ -3,14 +3,10 @@ "id": "GHSA-7vcx-v65q-9wpg", "modified": "2023-01-11T23:53:34Z", "published": "2023-01-11T23:53:34Z", - "aliases": [ - - ], + "aliases": [], "summary": "XML-RPC for PHP's `Wrapper::buildClientWrapperCode` method allows code injection via malicious `$client` argument", "details": "In order for this weakness to be exploited, the following conditions have to apply, at the same time:\n\n- method `Wrapper::buildClientWrapperCode`, or any methods which depend on it, such as `Wrapper::wrapXmlrpcServer`, `Wrapper::wrapXmlrpcMethod` or `Wrapper::buildWrapMethodSource` must be in use. Note that they are _not_ used by default in either the Client or Server classes provided by the library; the developer has to specifically make use of them in his/her own code\n- the `$client` argument to either of those methods should have been built with malicious data, ie. data controlled by a 3rd party, passed to its constructor call\n\nThis is most likely an uncommon usage scenario, and as such the chances of exploitation may be low.\n\n*NB* the graphical debugger which is shipped as part of the library is vulnerable to this, when used with the option \"Generate stub for method call\" selected. In that case, the debugger will _display_ but not _execute_ the malicious code, which would have to be provided via carefully crafted values for the \"Address\" and \"Path\" inputs.\n\nThe attack scenario in this case is that a developer copies into his/her own source code the php snippet generated by the debugger, in a situation where the debugger is used with \"Address\"/\"Path\" input values supplied by a 3rd party.\nThe malicious payload in the \"Address\"/\"Path\" input values should be easily recognized as suspicious by any barely proficient developer, as it resembles a bog-standard injection attack.\nIt goes without saying that a responsible developer should not blindly copy and paste into his/her own code anything generated by a 3rd party tool, such as the phpxmlrpc debugger, without giving it at least a cursory scan.\n\nOriginally reported as issue #80", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2023/01/GHSA-h6p3-p4vx-wr8q/GHSA-h6p3-p4vx-wr8q.json b/advisories/github-reviewed/2023/01/GHSA-h6p3-p4vx-wr8q/GHSA-h6p3-p4vx-wr8q.json index c1b54ea236f..e4af0e314fa 100644 --- a/advisories/github-reviewed/2023/01/GHSA-h6p3-p4vx-wr8q/GHSA-h6p3-p4vx-wr8q.json +++ b/advisories/github-reviewed/2023/01/GHSA-h6p3-p4vx-wr8q/GHSA-h6p3-p4vx-wr8q.json @@ -3,14 +3,10 @@ "id": "GHSA-h6p3-p4vx-wr8q", "modified": "2023-01-11T23:47:24Z", "published": "2023-01-11T23:47:24Z", - "aliases": [ - - ], + "aliases": [], "summary": "dompurify vulnerable to Cross-site Scripting", "details": "dompurify prior to version 2.2.3 is vulnerable to a cross-site scripting problem caused by nested headlines.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { @@ -51,9 +47,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-01-11T23:47:24Z", diff --git a/advisories/github-reviewed/2023/01/GHSA-m95x-m25c-w9mp/GHSA-m95x-m25c-w9mp.json b/advisories/github-reviewed/2023/01/GHSA-m95x-m25c-w9mp/GHSA-m95x-m25c-w9mp.json index 163b50268b8..1154506d936 100644 --- a/advisories/github-reviewed/2023/01/GHSA-m95x-m25c-w9mp/GHSA-m95x-m25c-w9mp.json +++ b/advisories/github-reviewed/2023/01/GHSA-m95x-m25c-w9mp/GHSA-m95x-m25c-w9mp.json @@ -3,14 +3,10 @@ "id": "GHSA-m95x-m25c-w9mp", "modified": "2023-01-11T23:54:47Z", "published": "2023-01-11T23:54:47Z", - "aliases": [ - - ], + "aliases": [], "summary": "XML-RPC for PHP allows access to local files via malicious argument to the Client::send method", "details": "Abusing the `$method` argument of Client::send, it was possible to force the client to _access local files_ or _connect to undesired urls_ instead of the intended target server's url (the one used in the Client constructor).\n\nThis weakness only affects installations where all the following conditions apply, at the same time:\n\n- the xmlrpc Client is used, ie. not xmlrpc servers\n- untrusted data (eg. data from remote users) is used as value for the `$method` argument of method `Client::send()`, in conjunction with conditions which trigger usage of curl as http transport (ie. either using the https, http11 or http2 protocols, or calling `Client::setUseCurl()` beforehand)\n- either have set the Clients `return_type` property to 'xml', or make the resulting Response's object `httpResponse` member, which is intended to be used for debugging purposes only, available to 3rd parties, eg. by displaying it to the end user or serializing it in some storage (note that the same data can also be accessed via magic property `Response::raw_data`, and in the Request's `httpResponse` member)\n\nThis is most likely a very uncommon usage scenario, and as such the chances of exploitation of this issue may be low.\n\nIf it is not possible to upgrade to this release of the library at this time, a proactive security measure, to avoid the Client accessing any local file on the server which hosts it, is to add the following call to your code:\n\n $client->setCurlOptions([CURLOPT_PROTOCOLS, CURLPROTO_HTTPS|CURLPROTO_HTTP]);\n\nOriginally reported as issue #81", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { @@ -51,9 +47,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-01-11T23:54:47Z", diff --git a/advisories/github-reviewed/2023/01/GHSA-pxqj-xrv5-qvjf/GHSA-pxqj-xrv5-qvjf.json b/advisories/github-reviewed/2023/01/GHSA-pxqj-xrv5-qvjf/GHSA-pxqj-xrv5-qvjf.json index 7b67cba64de..b0ceeba8af4 100644 --- a/advisories/github-reviewed/2023/01/GHSA-pxqj-xrv5-qvjf/GHSA-pxqj-xrv5-qvjf.json +++ b/advisories/github-reviewed/2023/01/GHSA-pxqj-xrv5-qvjf/GHSA-pxqj-xrv5-qvjf.json @@ -3,14 +3,10 @@ "id": "GHSA-pxqj-xrv5-qvjf", "modified": "2023-01-11T23:51:00Z", "published": "2023-01-11T23:51:00Z", - "aliases": [ - - ], + "aliases": [], "summary": "XML-RPC for PHP's debugger vulnerable to possible XSS attack", "details": "The bundled xml-rpc debugger is susceptible to XSS attacks.\n\nSince the debugger is not designed to be exposed to end users but only to the developers using this library, and in the default configuration it is not exposed to requests from the web, the likelihood of exploitation may be low.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2023/03/GHSA-5x5q-8cgm-2hjq/GHSA-5x5q-8cgm-2hjq.json b/advisories/github-reviewed/2023/03/GHSA-5x5q-8cgm-2hjq/GHSA-5x5q-8cgm-2hjq.json index d28ee6d5bda..4d545dc068b 100644 --- a/advisories/github-reviewed/2023/03/GHSA-5x5q-8cgm-2hjq/GHSA-5x5q-8cgm-2hjq.json +++ b/advisories/github-reviewed/2023/03/GHSA-5x5q-8cgm-2hjq/GHSA-5x5q-8cgm-2hjq.json @@ -3,9 +3,7 @@ "id": "GHSA-5x5q-8cgm-2hjq", "modified": "2024-10-28T17:50:02Z", "published": "2023-03-31T22:44:09Z", - "aliases": [ - - ], + "aliases": [], "summary": "Karate has vulnerable dependency on json-smart package (CVE-2023-1370)", "details": "### Summary\nThe CVE \n![image](https://user-images.githubusercontent.com/2663049/229081854-1155c041-56fa-48ca-a7ff-f2f085b845fd.png)\n\n\n### How to fix it\nVery simple, just upgrade json-path package to 2.8.0 (from 2.7.0) inside karate-core pom.xml ;)\n", "severity": [ diff --git a/advisories/github-reviewed/2023/04/GHSA-3qj8-93xh-pwh2/GHSA-3qj8-93xh-pwh2.json b/advisories/github-reviewed/2023/04/GHSA-3qj8-93xh-pwh2/GHSA-3qj8-93xh-pwh2.json index 44c4c0e9ab9..91eff5ba2c6 100644 --- a/advisories/github-reviewed/2023/04/GHSA-3qj8-93xh-pwh2/GHSA-3qj8-93xh-pwh2.json +++ b/advisories/github-reviewed/2023/04/GHSA-3qj8-93xh-pwh2/GHSA-3qj8-93xh-pwh2.json @@ -4,9 +4,7 @@ "modified": "2024-10-28T15:22:00Z", "published": "2023-04-21T18:30:24Z", "withdrawn": "2024-10-28T15:22:00Z", - "aliases": [ - - ], + "aliases": [], "summary": "Duplicate Advisory: Starlette allows an unauthenticated and remote attacker to specify any number of form fields or files", "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-74m5-2c7w-9w3x. This link is maintained to preserve external references.\n\n## Original Description\nThere MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.", "severity": [ diff --git a/advisories/github-reviewed/2023/07/GHSA-x96g-95fq-4xv4/GHSA-x96g-95fq-4xv4.json b/advisories/github-reviewed/2023/07/GHSA-x96g-95fq-4xv4/GHSA-x96g-95fq-4xv4.json index 4d51cf0521e..83671d7ddb5 100644 --- a/advisories/github-reviewed/2023/07/GHSA-x96g-95fq-4xv4/GHSA-x96g-95fq-4xv4.json +++ b/advisories/github-reviewed/2023/07/GHSA-x96g-95fq-4xv4/GHSA-x96g-95fq-4xv4.json @@ -8,9 +8,7 @@ ], "summary": "libostree vulnerable to denial of service attack", "details": "An issue was discovered in ostree before version 0.17.1 allows attackers to cause a denial of service via the print_panic function in repo_checkout_filter.rs.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { @@ -55,9 +53,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-12-20T23:16:17Z", diff --git a/advisories/github-reviewed/2023/09/GHSA-92jh-gwch-jq38/GHSA-92jh-gwch-jq38.json b/advisories/github-reviewed/2023/09/GHSA-92jh-gwch-jq38/GHSA-92jh-gwch-jq38.json index 27aca1fcaf6..fc30029a4c2 100644 --- a/advisories/github-reviewed/2023/09/GHSA-92jh-gwch-jq38/GHSA-92jh-gwch-jq38.json +++ b/advisories/github-reviewed/2023/09/GHSA-92jh-gwch-jq38/GHSA-92jh-gwch-jq38.json @@ -3,9 +3,7 @@ "id": "GHSA-92jh-gwch-jq38", "modified": "2024-05-23T20:46:33Z", "published": "2023-09-14T17:10:37Z", - "aliases": [ - - ], + "aliases": [], "summary": "PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)", "details": "### Impact\nAn attacker could crash PocketMine-MP by sending malformed JSON in `LoginPacket`.\n\nThis happened due to the particular handling of NULL types in the json mapper which accepts NULL type values in typed arrays which PocketMine-MP did not expect.\n\n Code processing arrays in the JSON data could then crash due to unexpected `NULL` elements.\n\n### Patches\nThis problem was fixed in 5.3.1 and 4.23.1 by updating JsonMapper to include the following commit: pmmp/netresearch-jsonmapper@4f90e8dab1c9df331fad7d3d89823404e882668c\n\nAn upstream patch for this issue was proposed via https://github.com/cweiske/jsonmapper/pull/211; however, as of 2024-05-15, the patch has not been accepted upstream due to debate about how to deal with the behavior. For now, a fork of JsonMapper is used by PocketMine-MP to workaround the issue.\n\n### Workarounds\nA plugin may handle `DataPacketReceiveEvent` for `LoginPacket` and check that none of the input arrays contain `NULL` where it's not expected, but this is rather cumbersome.\n\n### References\nProposed upstream patch for a behavior change: https://github.com/cweiske/jsonmapper/pull/211", "severity": [ @@ -75,9 +73,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-09-14T17:10:37Z", diff --git a/advisories/github-reviewed/2023/09/GHSA-rjqg-3h9m-fx5x/GHSA-rjqg-3h9m-fx5x.json b/advisories/github-reviewed/2023/09/GHSA-rjqg-3h9m-fx5x/GHSA-rjqg-3h9m-fx5x.json index 2073dcbaea6..51eef712844 100644 --- a/advisories/github-reviewed/2023/09/GHSA-rjqg-3h9m-fx5x/GHSA-rjqg-3h9m-fx5x.json +++ b/advisories/github-reviewed/2023/09/GHSA-rjqg-3h9m-fx5x/GHSA-rjqg-3h9m-fx5x.json @@ -8,9 +8,7 @@ ], "summary": "Cache poisoning in drupal/core", "details": "In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.\n\nThis vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.\n\nThe core REST and contributed GraphQL modules are not affected.\n\n\n\n", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2023/12/GHSA-9wgg-m99q-hhfc/GHSA-9wgg-m99q-hhfc.json b/advisories/github-reviewed/2023/12/GHSA-9wgg-m99q-hhfc/GHSA-9wgg-m99q-hhfc.json index a81b9242c4e..380c510fead 100644 --- a/advisories/github-reviewed/2023/12/GHSA-9wgg-m99q-hhfc/GHSA-9wgg-m99q-hhfc.json +++ b/advisories/github-reviewed/2023/12/GHSA-9wgg-m99q-hhfc/GHSA-9wgg-m99q-hhfc.json @@ -3,9 +3,7 @@ "id": "GHSA-9wgg-m99q-hhfc", "modified": "2023-12-20T17:54:54Z", "published": "2023-12-19T23:12:03Z", - "aliases": [ - - ], + "aliases": [], "summary": "Expired tokens can be renewed without validating the account password", "details": "### Impact\nIn versions of the proxy from `2022-09-05` onwards (since 8c874c2ff3d503ac20c7d32f46e08547fcb9e23f), expired OAuth 2.0 client credentials grant (CCG) flow authorisation tokens could be renewed automatically without checking their validity against the original account configuration (i.e., the password that was set up when first creating an account in the proxy).\n\nAn attacker with knowledge of valid account addresses and careful timing (specifically, attempting to log in during a period from 10 minutes prior to the token expiry time, but before a genuine login request is received) could use this issue to gain access to an account.\n\nThis issue is only a security concern if you use the proxy with the CCG flow and no additional account secret encryption (see below). If this is the case, it is particularly important to update if you use the proxy in a publicly-accessible setting (i.e., it is available from the internet or across a network). To fix the issue you should switch to version [`2023-12-19`](https://github.com/simonrob/email-oauth2-proxy/releases/tag/2023-12-19) or later of the proxy immediately.\n\nIf you use this flow, but have also set `encrypt_client_secret_on_first_use = True` *and* removed the original `client_secret` value from the proxy's configuration file then this issue is not a concern.\n\nFor all other use-cases (e.g., a normal interactive account authentication, or the ROPCG flow), this issue is also not a concern. However, it is always recommended as best practice to keep the proxy up-to-date.\n\n\n### Patches\n[Email OAuth 2.0 Proxy version `2023-12-19`](https://github.com/simonrob/email-oauth2-proxy/releases/tag/2023-12-19) (commit eaaa1a2e7a132bf0958dd2f99a749ad98e3212aa) fixes this issue.\n\n\n### Issue details\nBecause it was originally designed for use as an interactive, local-only service on a single device, the proxy automatically resets account access tokens if incorrect IMAP/POP/SMTP login details are provided. For public-facing deployments, the `delete_account_token_on_password_error` option is provided, and can be set to `False` to disable this behaviour, which would normally be only a nuisance, rather than a security risk.\n\nRegardless of this option's value, the proxy encrypts locally-stored tokens, and requires interactive re-authentication (or, with the resource owner password credentials grant (ROPCG) flow, the correct remote account password) to renew tokens if they expire or are reset. The proxy's token retrieval implementation was created with this interactive process in mind.\n\nThe CCG flow is an administrator-level method that grants broad access without user knowledge or consent – no user interaction (or remote account password) is ever required. From 8c874c2ff3d503ac20c7d32f46e08547fcb9e23f until the fix in eaaa1a2e7a132bf0958dd2f99a749ad98e3212aa, when CCG tokens neared their expiry date (or had already expired), and the original unencrypted `client_secret` value was available they were automatically reset, renewed and encrypted with the given login password, but without checking whether that password was actually able to decrypt the _existing_ token.\n\n\n### Detecting unauthorised access\nIf you do not use the OAuth 2.0 CCG flow (which is currently only known to be supported by O365), unauthorised account access was not possible.[^1] Attempts to exploit this flaw will be revealed in the same way as any other malicious access: an unexpected reauthorisation prompt from the proxy when trying to log in with the legitimate account details.\n\nWhen using the CCG flow, if you have set `delete_account_token_on_password_error = False`, unauthorised access will be revealed by the presence of an unexpected login failure from the proxy when attempting to log in with the correct password.\n\nIt you have not set this value, it is not possible to detect unauthorised access in O365 CCG mode except via AAD/Entra or other external logs. However, it is also worth reiterating that the CCG flow should never be used in a publicly-accessible context due to the significant and potentially dangerous account control it provides.\n\n[^1]: If you are using a provider that does not provide an OAuth 2.0 refresh token (or have configured your account's scope so that this is not present), it is possible to trigger the line of code that caused this issue, but there is no way to use it for account access because interactive authentication is still required.", "severity": [ diff --git a/advisories/github-reviewed/2024/02/GHSA-2557-x9mg-76w8/GHSA-2557-x9mg-76w8.json b/advisories/github-reviewed/2024/02/GHSA-2557-x9mg-76w8/GHSA-2557-x9mg-76w8.json index 9db4db3ec3e..92649ef8442 100644 --- a/advisories/github-reviewed/2024/02/GHSA-2557-x9mg-76w8/GHSA-2557-x9mg-76w8.json +++ b/advisories/github-reviewed/2024/02/GHSA-2557-x9mg-76w8/GHSA-2557-x9mg-76w8.json @@ -3,9 +3,7 @@ "id": "GHSA-2557-x9mg-76w8", "modified": "2024-05-23T18:32:11Z", "published": "2024-02-21T00:13:46Z", - "aliases": [ - - ], + "aliases": [], "summary": "ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`", "details": "## ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`\n\n**Component**: Cosmos SDK\n**Criticality**: Medium\n**Affected** Versions: Cosmos SDK versions <= 0.50.3; <= 0.47.8\n**Affected** Users: Chain developers, Validator and Node operators\n**Impact**: Denial of Service\n\n## Summary\n\nWhen using the default `PrepareProposalHandler` and the default `SenderNonceMempool`, an issue was identified which may allow invalid blocks to be proposed when a single sender includes multiple transactions with non-sequential sequence numbers in certain conditions. If this state is reached, it can lead to a reduction in block production for a network.\n\n## Next Steps for Impacted Parties\n\nIf you are a chain developer on an affected version of the Cosmos SDK, it is advised to update to the latest available version of the Cosmos SDK for your project. Once a patched version is available, it is recommended that network operators upgrade.\n\nA Github Security Advisory for this issue is available in the Cosmos-SDK [repository](https://github.com/cosmos/cosmos-sdk/security/advisories). For more information about Cosmos SDK, see https://docs.cosmos.network/.\n\nThis issue was found by [KonradStaniec](https://github.com/KonradStaniec), [gitferry](https://github.com/gitferry), [SebastianElvis](https://github.com/SebastianElvis), and [vitsalis](https://github.com/vitsalis) who reported it to the Cosmos Bug Bounty Program on HackerOne on January 16, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n", "severity": [ diff --git a/advisories/github-reviewed/2024/02/GHSA-34q3-p352-c7q8/GHSA-34q3-p352-c7q8.json b/advisories/github-reviewed/2024/02/GHSA-34q3-p352-c7q8/GHSA-34q3-p352-c7q8.json index 08a9cfc1bab..6b3b6852eb0 100644 --- a/advisories/github-reviewed/2024/02/GHSA-34q3-p352-c7q8/GHSA-34q3-p352-c7q8.json +++ b/advisories/github-reviewed/2024/02/GHSA-34q3-p352-c7q8/GHSA-34q3-p352-c7q8.json @@ -54,9 +54,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2024-02-02T16:55:25Z", diff --git a/advisories/github-reviewed/2024/02/GHSA-jjhx-jhvp-74wq/GHSA-jjhx-jhvp-74wq.json b/advisories/github-reviewed/2024/02/GHSA-jjhx-jhvp-74wq/GHSA-jjhx-jhvp-74wq.json index 26ddab7a765..73f01b07bde 100644 --- a/advisories/github-reviewed/2024/02/GHSA-jjhx-jhvp-74wq/GHSA-jjhx-jhvp-74wq.json +++ b/advisories/github-reviewed/2024/02/GHSA-jjhx-jhvp-74wq/GHSA-jjhx-jhvp-74wq.json @@ -8,9 +8,7 @@ ], "summary": "Rails has possible ReDoS vulnerability in Accept header parsing in Action Dispatch", "details": "# Possible ReDoS vulnerability in Accept header parsing in Action Dispatch\n\nThere is a possible ReDoS vulnerability in the Accept header parsing routines\nof Action Dispatch. This vulnerability has been assigned the CVE identifier\nCVE-2024-26142.\n\nVersions Affected: >= 7.1.0, < 7.1.3.1\nNot affected: < 7.1.0\nFixed Versions: 7.1.3.1\n\nImpact\n------\nCarefully crafted Accept headers can cause Accept header parsing in Action\nDispatch to take an unexpected amount of time, possibly resulting in a DoS\nvulnerability. All users running an affected release should either upgrade or\nuse one of the workarounds immediately.\n\nRuby 3.2 has mitigations for this problem, so Rails applications using Ruby\n3.2 or newer are unaffected.\n\nReleases\n--------\nThe fixed releases are available at the normal locations.\n\nWorkarounds\n-----------\nThere are no feasible workarounds for this issue.\n\nPatches\n-------\nTo aid users who aren't able to upgrade immediately we have provided patches for\nthe two supported release series. They are in git-am format and consist of a\nsingle changeset.\n\n* 7-1-accept-redox.patch - Patch for 7.1 series\n\nCredits\n-------\nThanks [svalkanov](https://hackerone.com/svalkanov) for the report and patch!", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2024/02/GHSA-rc4p-p3j9-6577/GHSA-rc4p-p3j9-6577.json b/advisories/github-reviewed/2024/02/GHSA-rc4p-p3j9-6577/GHSA-rc4p-p3j9-6577.json index c3343bed4cb..43c45dc2b63 100644 --- a/advisories/github-reviewed/2024/02/GHSA-rc4p-p3j9-6577/GHSA-rc4p-p3j9-6577.json +++ b/advisories/github-reviewed/2024/02/GHSA-rc4p-p3j9-6577/GHSA-rc4p-p3j9-6577.json @@ -3,9 +3,7 @@ "id": "GHSA-rc4p-p3j9-6577", "modified": "2024-03-19T18:27:04Z", "published": "2024-02-22T21:41:47Z", - "aliases": [ - - ], + "aliases": [], "summary": "pypqc private key retrieval vulnerability", "details": "### Impact\n`kyber512`, `kyber768`, and `kyber1024` only: An attacker able to submit many decapsulation requests against a single private key, and to gain timing information about the decapsulation, could recover the private key. Proof-of-concept exploit exists for a local attacker.\n\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P/RL:O/RC:C \n\n### Patches\nVersion 0.0.6.1 and newer of PyPQC is patched.\n\n### Workarounds\nNo workarounds have been reported. The 0.0.6 -> 0.0.6.1 upgrade should be a drop-in replacement; it has no known breaking changes.\n\n### References\n#### Timeline\n1. Cryspen researchers privately reported KyberSlash to the reference implementation maintainers.\n\n2. Peter Schwabe partially patched KyberSlash \\(only \"KyberSlash 1\"\\) in the reference implementation on December 1st, 2023, but did not document or advertise this as a security patch. \n https://www.github.com/pq-crystals/kyber/commit/dda29cc63af721981ee2c831cf00822e69be3220\n\n3. Daniel J. Bernstein publicly reported KyberSlash as a security issue on December 15th, 2023. \n https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/hWqFJCucuj4/m/-Z-jm_k9AAAJ\n\n4. Daniel J. Bernstein created a webpage for authoritative reference about KyberSlash on December 19th, 2023. \n https://kyberslash.cr.yp.to/\n\n5. Thom Wiggers acknowledged KyberSlash as a security issue on December 19th, 2023. \n https://www.github.com/PQClean/PQClean/issues/533\n\n6. Prasanna Ravi and Matthias Kannwischer privately reported further details about KyberSlash \\(\"KyberSlash 2\"\\) to the reference implementation maintainers.\n\n7. Peter Schwabe completely patched KyberSlash in the reference implementation on December 29th, 2023.\n https://www.github.com/pq-crystals/kyber/commit/11d00ff1f20cfca1f72d819e5a45165c1e0a2816\n\n8. Prasanna Ravi and Matthias Kannwischer publicly reported their findings \\(\"KyberSlash 2\"\\) on December 30th, 2023. \n https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/ldX0ThYJuBo/m/ovODsdY7AwAJ\n\n9. Daniel J. Bernstein published a proof-of-concept exploit \\(only validated for a local attacker\\) for KyberSlash on December 30th, 2023. \n https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/ldX0ThYJuBo/m/uIOqRF5BAwAJ\n\n10. Thom Wiggers completely patched KyberSlash in PQClean on January 25th, 2024. \n https://www.github.com/PQClean/PQClean/commit/3b43bc6fe46fe47be38f87af5019a7f1462ae6dd\n\n11. James E. A. completely patched KyberSlash in pypqc and released a security update on January 26th, 2024. \n https://www.github.com/JamesTheAwesomeDude/pypqc/commit/b33fec8cd36e865f8db6215c64b2d01f429a1ed6", "severity": [ @@ -78,9 +76,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-02-22T21:41:47Z", diff --git a/advisories/github-reviewed/2024/03/GHSA-68c2-4mpx-qh95/GHSA-68c2-4mpx-qh95.json b/advisories/github-reviewed/2024/03/GHSA-68c2-4mpx-qh95/GHSA-68c2-4mpx-qh95.json index d8c3cad9744..e041d592519 100644 --- a/advisories/github-reviewed/2024/03/GHSA-68c2-4mpx-qh95/GHSA-68c2-4mpx-qh95.json +++ b/advisories/github-reviewed/2024/03/GHSA-68c2-4mpx-qh95/GHSA-68c2-4mpx-qh95.json @@ -3,14 +3,10 @@ "id": "GHSA-68c2-4mpx-qh95", "modified": "2024-03-01T16:57:56Z", "published": "2024-03-01T16:57:56Z", - "aliases": [ - - ], + "aliases": [], "summary": "Potential leakage of Sentry auth tokens by React Native SDK with Expo plugin", "details": "### Impact\nSDK versions between and including 5.16.0 and 5.19.0 allowed Sentry auth tokens to be set in the optional authToken configuration parameter, for debugging purposes. Doing so would result in the auth token being built into the application bundle, and therefore the auth token could be potentially exposed in case the application bundle is subsequently published.\n\nYou may ignore this notification if you are not using `authToken` configuration parameter in your React Native SDK configuration or did not publish apps using this way of configuring the `authToken`.\n\nIf you had set the `authToken` in the plugin config previously, and built and published an app with that config, you should [rotate your token](https://docs.sentry.io/product/accounts/auth-tokens/).\n\n### Patches\nThe behavior that allowed setting an `authToken` parameter was fixed in SDK version 5.19.1 where, if this parameter was set, you will see a warning and the `authToken` would be removed before bundling the application.\n\n### Workarounds\n1. Remove `authToken` from the plugin configuration.\n2. If you had set the `authToken` in the plugin config previously, and built and published an app with that config, you should [rotate your token](https://docs.sentry.io/product/accounts/auth-tokens/).\n\n### References\n* [sentry-react-native 5.19.1 release notes](https://github.com/getsentry/sentry-react-native/releases/tag/5.19.1)\n* https://github.com/getsentry/sentry-docs/pull/9244", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2024/03/GHSA-6jvg-hp25-42f6/GHSA-6jvg-hp25-42f6.json b/advisories/github-reviewed/2024/03/GHSA-6jvg-hp25-42f6/GHSA-6jvg-hp25-42f6.json index d7a8c577c87..a0132aacb9c 100644 --- a/advisories/github-reviewed/2024/03/GHSA-6jvg-hp25-42f6/GHSA-6jvg-hp25-42f6.json +++ b/advisories/github-reviewed/2024/03/GHSA-6jvg-hp25-42f6/GHSA-6jvg-hp25-42f6.json @@ -8,9 +8,7 @@ ], "summary": "Nteract Remote Code Execution vulnerability", "details": "Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/unreviewed/2021/12/GHSA-7ffc-hwfp-9xhq/GHSA-7ffc-hwfp-9xhq.json b/advisories/unreviewed/2021/12/GHSA-7ffc-hwfp-9xhq/GHSA-7ffc-hwfp-9xhq.json index 5e5b19523a8..18f44441bdd 100644 --- a/advisories/unreviewed/2021/12/GHSA-7ffc-hwfp-9xhq/GHSA-7ffc-hwfp-9xhq.json +++ b/advisories/unreviewed/2021/12/GHSA-7ffc-hwfp-9xhq/GHSA-7ffc-hwfp-9xhq.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-gpcr-2fv6-73fj/GHSA-gpcr-2fv6-73fj.json b/advisories/unreviewed/2021/12/GHSA-gpcr-2fv6-73fj/GHSA-gpcr-2fv6-73fj.json index 9cdc410d6d2..004c9513994 100644 --- a/advisories/unreviewed/2021/12/GHSA-gpcr-2fv6-73fj/GHSA-gpcr-2fv6-73fj.json +++ b/advisories/unreviewed/2021/12/GHSA-gpcr-2fv6-73fj/GHSA-gpcr-2fv6-73fj.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-jf2m-jhcf-5xqg/GHSA-jf2m-jhcf-5xqg.json b/advisories/unreviewed/2021/12/GHSA-jf2m-jhcf-5xqg/GHSA-jf2m-jhcf-5xqg.json index 61920a60002..61ff217bf97 100644 --- a/advisories/unreviewed/2021/12/GHSA-jf2m-jhcf-5xqg/GHSA-jf2m-jhcf-5xqg.json +++ b/advisories/unreviewed/2021/12/GHSA-jf2m-jhcf-5xqg/GHSA-jf2m-jhcf-5xqg.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-p533-v77v-4gcf/GHSA-p533-v77v-4gcf.json b/advisories/unreviewed/2021/12/GHSA-p533-v77v-4gcf/GHSA-p533-v77v-4gcf.json index 4da9fe13770..3d82df560a0 100644 --- a/advisories/unreviewed/2021/12/GHSA-p533-v77v-4gcf/GHSA-p533-v77v-4gcf.json +++ b/advisories/unreviewed/2021/12/GHSA-p533-v77v-4gcf/GHSA-p533-v77v-4gcf.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -31,9 +29,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2021/12/GHSA-vw96-55hq-p2pg/GHSA-vw96-55hq-p2pg.json b/advisories/unreviewed/2021/12/GHSA-vw96-55hq-p2pg/GHSA-vw96-55hq-p2pg.json index 090f482c41a..7f3c82f453d 100644 --- a/advisories/unreviewed/2021/12/GHSA-vw96-55hq-p2pg/GHSA-vw96-55hq-p2pg.json +++ b/advisories/unreviewed/2021/12/GHSA-vw96-55hq-p2pg/GHSA-vw96-55hq-p2pg.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-w4w9-rwjc-mvgm/GHSA-w4w9-rwjc-mvgm.json b/advisories/unreviewed/2021/12/GHSA-w4w9-rwjc-mvgm/GHSA-w4w9-rwjc-mvgm.json index bdd259d4591..8ba38a406f8 100644 --- a/advisories/unreviewed/2021/12/GHSA-w4w9-rwjc-mvgm/GHSA-w4w9-rwjc-mvgm.json +++ b/advisories/unreviewed/2021/12/GHSA-w4w9-rwjc-mvgm/GHSA-w4w9-rwjc-mvgm.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-w5vj-23fw-q536/GHSA-w5vj-23fw-q536.json b/advisories/unreviewed/2021/12/GHSA-w5vj-23fw-q536/GHSA-w5vj-23fw-q536.json index 93ef93c0b81..332c7c6f5e8 100644 --- a/advisories/unreviewed/2021/12/GHSA-w5vj-23fw-q536/GHSA-w5vj-23fw-q536.json +++ b/advisories/unreviewed/2021/12/GHSA-w5vj-23fw-q536/GHSA-w5vj-23fw-q536.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/01/GHSA-c76g-xw7w-9qj6/GHSA-c76g-xw7w-9qj6.json b/advisories/unreviewed/2022/01/GHSA-c76g-xw7w-9qj6/GHSA-c76g-xw7w-9qj6.json index 1934bbb6705..7be17a9632b 100644 --- a/advisories/unreviewed/2022/01/GHSA-c76g-xw7w-9qj6/GHSA-c76g-xw7w-9qj6.json +++ b/advisories/unreviewed/2022/01/GHSA-c76g-xw7w-9qj6/GHSA-c76g-xw7w-9qj6.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/01/GHSA-jpgp-wjp4-f47j/GHSA-jpgp-wjp4-f47j.json b/advisories/unreviewed/2022/01/GHSA-jpgp-wjp4-f47j/GHSA-jpgp-wjp4-f47j.json index fb93586955c..dc629321bd8 100644 --- a/advisories/unreviewed/2022/01/GHSA-jpgp-wjp4-f47j/GHSA-jpgp-wjp4-f47j.json +++ b/advisories/unreviewed/2022/01/GHSA-jpgp-wjp4-f47j/GHSA-jpgp-wjp4-f47j.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/01/GHSA-p5g5-mjp3-mr9m/GHSA-p5g5-mjp3-mr9m.json b/advisories/unreviewed/2022/01/GHSA-p5g5-mjp3-mr9m/GHSA-p5g5-mjp3-mr9m.json index 95d8e8d3c5b..c8ad28049e9 100644 --- a/advisories/unreviewed/2022/01/GHSA-p5g5-mjp3-mr9m/GHSA-p5g5-mjp3-mr9m.json +++ b/advisories/unreviewed/2022/01/GHSA-p5g5-mjp3-mr9m/GHSA-p5g5-mjp3-mr9m.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/02/GHSA-cxfw-78g3-3grg/GHSA-cxfw-78g3-3grg.json b/advisories/unreviewed/2022/02/GHSA-cxfw-78g3-3grg/GHSA-cxfw-78g3-3grg.json index 1984759782f..0cac4766c56 100644 --- a/advisories/unreviewed/2022/02/GHSA-cxfw-78g3-3grg/GHSA-cxfw-78g3-3grg.json +++ b/advisories/unreviewed/2022/02/GHSA-cxfw-78g3-3grg/GHSA-cxfw-78g3-3grg.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/02/GHSA-h872-jxr7-q7rj/GHSA-h872-jxr7-q7rj.json b/advisories/unreviewed/2022/02/GHSA-h872-jxr7-q7rj/GHSA-h872-jxr7-q7rj.json index f5d7c0efaac..ea883a2507f 100644 --- a/advisories/unreviewed/2022/02/GHSA-h872-jxr7-q7rj/GHSA-h872-jxr7-q7rj.json +++ b/advisories/unreviewed/2022/02/GHSA-h872-jxr7-q7rj/GHSA-h872-jxr7-q7rj.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/02/GHSA-hv3v-c734-65qr/GHSA-hv3v-c734-65qr.json b/advisories/unreviewed/2022/02/GHSA-hv3v-c734-65qr/GHSA-hv3v-c734-65qr.json index eb5adee20c3..b36e8711e0f 100644 --- a/advisories/unreviewed/2022/02/GHSA-hv3v-c734-65qr/GHSA-hv3v-c734-65qr.json +++ b/advisories/unreviewed/2022/02/GHSA-hv3v-c734-65qr/GHSA-hv3v-c734-65qr.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -27,9 +25,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/02/GHSA-mvgm-c55v-5wjw/GHSA-mvgm-c55v-5wjw.json b/advisories/unreviewed/2022/02/GHSA-mvgm-c55v-5wjw/GHSA-mvgm-c55v-5wjw.json index fb4c32ef4c4..f25621e6da0 100644 --- a/advisories/unreviewed/2022/02/GHSA-mvgm-c55v-5wjw/GHSA-mvgm-c55v-5wjw.json +++ b/advisories/unreviewed/2022/02/GHSA-mvgm-c55v-5wjw/GHSA-mvgm-c55v-5wjw.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/02/GHSA-w3q4-xr8h-32gf/GHSA-w3q4-xr8h-32gf.json b/advisories/unreviewed/2022/02/GHSA-w3q4-xr8h-32gf/GHSA-w3q4-xr8h-32gf.json index 00cce08eba5..2045a4c8fea 100644 --- a/advisories/unreviewed/2022/02/GHSA-w3q4-xr8h-32gf/GHSA-w3q4-xr8h-32gf.json +++ b/advisories/unreviewed/2022/02/GHSA-w3q4-xr8h-32gf/GHSA-w3q4-xr8h-32gf.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/04/GHSA-2wff-r89p-gqg6/GHSA-2wff-r89p-gqg6.json b/advisories/unreviewed/2022/04/GHSA-2wff-r89p-gqg6/GHSA-2wff-r89p-gqg6.json index 635fbbc9cd8..db0833c00b9 100644 --- a/advisories/unreviewed/2022/04/GHSA-2wff-r89p-gqg6/GHSA-2wff-r89p-gqg6.json +++ b/advisories/unreviewed/2022/04/GHSA-2wff-r89p-gqg6/GHSA-2wff-r89p-gqg6.json @@ -7,12 +7,8 @@ "CVE-2004-2264" ], "details": "** DISPUTED ** Format string bug in the open_altfile function in filename.c for GNU less 382, 381, and 358 might allow local users to cause a denial of service or possibly execute arbitrary code via format strings in the LESSOPEN environment variable. NOTE: since less is not setuid or setgid, then this is not a vulnerability unless there are plausible scenarios under which privilege boundaries could be crossed.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -40,9 +36,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/04/GHSA-39pc-77xc-3q8f/GHSA-39pc-77xc-3q8f.json b/advisories/unreviewed/2022/04/GHSA-39pc-77xc-3q8f/GHSA-39pc-77xc-3q8f.json index 79be613a380..85784745087 100644 --- a/advisories/unreviewed/2022/04/GHSA-39pc-77xc-3q8f/GHSA-39pc-77xc-3q8f.json +++ b/advisories/unreviewed/2022/04/GHSA-39pc-77xc-3q8f/GHSA-39pc-77xc-3q8f.json @@ -7,12 +7,8 @@ "CVE-2004-1621" ], "details": "** DISPUTED ** NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in IBM Lotus Notes R6 and Domino R6, and possibly earlier versions, allows remote attackers to execute arbitrary web script or HTML via square brackets at the beginning and end of (1) computed for display, (2) computed when composed, or (3) computed text element fields. NOTE: the vendor has disputed this issue, saying that it is not a problem with Notes/Domino itself, but with the applications that do not properly handle this feature.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -52,9 +48,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/04/GHSA-3v3x-cm3g-974v/GHSA-3v3x-cm3g-974v.json b/advisories/unreviewed/2022/04/GHSA-3v3x-cm3g-974v/GHSA-3v3x-cm3g-974v.json index 63caba12898..c1f88ac0bd8 100644 --- a/advisories/unreviewed/2022/04/GHSA-3v3x-cm3g-974v/GHSA-3v3x-cm3g-974v.json +++ b/advisories/unreviewed/2022/04/GHSA-3v3x-cm3g-974v/GHSA-3v3x-cm3g-974v.json @@ -7,12 +7,8 @@ "CVE-2004-2722" ], "details": "** DISPUTED ** Nessus 2.0.10a stores account passwords in plaintext in .nessusrc files, which allows local users to obtain passwords. NOTE: the original researcher reports that the vendor has disputed this issue.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -36,9 +32,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/04/GHSA-56hw-fjf6-ccpj/GHSA-56hw-fjf6-ccpj.json b/advisories/unreviewed/2022/04/GHSA-56hw-fjf6-ccpj/GHSA-56hw-fjf6-ccpj.json index a905f3b7196..f78b1f5f8fb 100644 --- a/advisories/unreviewed/2022/04/GHSA-56hw-fjf6-ccpj/GHSA-56hw-fjf6-ccpj.json +++ b/advisories/unreviewed/2022/04/GHSA-56hw-fjf6-ccpj/GHSA-56hw-fjf6-ccpj.json @@ -7,12 +7,8 @@ "CVE-2004-2339" ], "details": "** DISPUTED ** Microsoft Windows 2000, XP, and possibly 2003 allows local users with the SeDebugPrivilege privilege to execute arbitrary code as kernel and read or write kernel memory via the NtSystemDebugControl function, which does not verify its pointer arguments. Note: this issue has been disputed, since Administrator privileges are typically required to exploit this issue, thus privilege boundaries are not crossed.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -40,9 +36,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/04/GHSA-6f73-68xp-2x5w/GHSA-6f73-68xp-2x5w.json b/advisories/unreviewed/2022/04/GHSA-6f73-68xp-2x5w/GHSA-6f73-68xp-2x5w.json index 8c8dc9bc5e6..3836706fc74 100644 --- a/advisories/unreviewed/2022/04/GHSA-6f73-68xp-2x5w/GHSA-6f73-68xp-2x5w.json +++ b/advisories/unreviewed/2022/04/GHSA-6f73-68xp-2x5w/GHSA-6f73-68xp-2x5w.json @@ -7,12 +7,8 @@ "CVE-2001-1519" ], "details": "** DISPUTED ** RunAs (runas.exe) in Windows 2000 allows local users to create a spoofed named pipe when the service is stopped, then capture cleartext usernames and passwords when clients connect to the service. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to exploit it.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -36,9 +32,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/04/GHSA-6w2r-x6qc-ch2w/GHSA-6w2r-x6qc-ch2w.json b/advisories/unreviewed/2022/04/GHSA-6w2r-x6qc-ch2w/GHSA-6w2r-x6qc-ch2w.json index 8e09017065f..bdda20670c4 100644 --- a/advisories/unreviewed/2022/04/GHSA-6w2r-x6qc-ch2w/GHSA-6w2r-x6qc-ch2w.json +++ b/advisories/unreviewed/2022/04/GHSA-6w2r-x6qc-ch2w/GHSA-6w2r-x6qc-ch2w.json @@ -7,12 +7,8 @@ "CVE-2001-1517" ], "details": "** DISPUTED ** RunAs (runas.exe) in Windows 2000 stores cleartext authentication information in memory, which could allow attackers to obtain usernames and passwords by executing a process that is allocated the same memory page after termination of a RunAs command. NOTE: the vendor disputes this issue, saying that administrative privileges are already required to exploit it, and the original researcher did not respond to requests for additional information.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -36,9 +32,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/04/GHSA-8jm5-c7cw-v9hh/GHSA-8jm5-c7cw-v9hh.json b/advisories/unreviewed/2022/04/GHSA-8jm5-c7cw-v9hh/GHSA-8jm5-c7cw-v9hh.json index b1498644bb3..6c1940932d5 100644 --- a/advisories/unreviewed/2022/04/GHSA-8jm5-c7cw-v9hh/GHSA-8jm5-c7cw-v9hh.json +++ b/advisories/unreviewed/2022/04/GHSA-8jm5-c7cw-v9hh/GHSA-8jm5-c7cw-v9hh.json @@ -7,12 +7,8 @@ "CVE-2003-1307" ], "details": "** DISPUTED ** The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying \"The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP.\"", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -44,9 +40,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/04/GHSA-9wmv-xx8c-x6qw/GHSA-9wmv-xx8c-x6qw.json b/advisories/unreviewed/2022/04/GHSA-9wmv-xx8c-x6qw/GHSA-9wmv-xx8c-x6qw.json index 6f17cddc548..8fc63dfbae0 100644 --- a/advisories/unreviewed/2022/04/GHSA-9wmv-xx8c-x6qw/GHSA-9wmv-xx8c-x6qw.json +++ b/advisories/unreviewed/2022/04/GHSA-9wmv-xx8c-x6qw/GHSA-9wmv-xx8c-x6qw.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/04/GHSA-9ww3-p69f-h76f/GHSA-9ww3-p69f-h76f.json b/advisories/unreviewed/2022/04/GHSA-9ww3-p69f-h76f/GHSA-9ww3-p69f-h76f.json index 6c582a15847..3e2a5094376 100644 --- a/advisories/unreviewed/2022/04/GHSA-9ww3-p69f-h76f/GHSA-9ww3-p69f-h76f.json +++ b/advisories/unreviewed/2022/04/GHSA-9ww3-p69f-h76f/GHSA-9ww3-p69f-h76f.json @@ -7,12 +7,8 @@ "CVE-2002-2379" ], "details": "** DISPUTED ** Cisco AS5350 IOS 12.2(11)T with access control lists (ACLs) applied and possibly with ssh running allows remote attackers to cause a denial of service (crash) via a port scan, possibly due to an ssh bug. NOTE: this issue could not be reproduced by the vendor.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -48,9 +44,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/04/GHSA-f5h8-mp5p-q6q4/GHSA-f5h8-mp5p-q6q4.json b/advisories/unreviewed/2022/04/GHSA-f5h8-mp5p-q6q4/GHSA-f5h8-mp5p-q6q4.json index 95c6107ea79..12209ce01bd 100644 --- a/advisories/unreviewed/2022/04/GHSA-f5h8-mp5p-q6q4/GHSA-f5h8-mp5p-q6q4.json +++ b/advisories/unreviewed/2022/04/GHSA-f5h8-mp5p-q6q4/GHSA-f5h8-mp5p-q6q4.json @@ -7,12 +7,8 @@ "CVE-2004-2713" ], "details": "** DISPUTED ** Zone Alarm Pro 1.0 through 5.1 gives full access to %windir%\\Internet Logs\\* to the EVERYONE group, which allows local users to cause a denial of service by modifying the folder contents or permissions. NOTE: this issue has been disputed by the vendor, who claims that it does not affect product functionality since the same information is also saved in a protected file.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -44,9 +40,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/04/GHSA-ffqx-92p8-2h7f/GHSA-ffqx-92p8-2h7f.json b/advisories/unreviewed/2022/04/GHSA-ffqx-92p8-2h7f/GHSA-ffqx-92p8-2h7f.json index 600d8cb2749..225d8194638 100644 --- a/advisories/unreviewed/2022/04/GHSA-ffqx-92p8-2h7f/GHSA-ffqx-92p8-2h7f.json +++ b/advisories/unreviewed/2022/04/GHSA-ffqx-92p8-2h7f/GHSA-ffqx-92p8-2h7f.json @@ -7,12 +7,8 @@ "CVE-2001-1533" ], "details": "** DISPUTED * Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service via a flood of fragmented UDP packets. NOTE: the vendor disputes this issue, saying that it requires high bandwidth to exploit, and the server does not experience any instability. Therefore this \"laws of physics\" issue might not be included in CVE.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -36,9 +32,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/04/GHSA-qgjc-6844-xqv9/GHSA-qgjc-6844-xqv9.json b/advisories/unreviewed/2022/04/GHSA-qgjc-6844-xqv9/GHSA-qgjc-6844-xqv9.json index 7e7928cbbf6..48392d0f827 100644 --- a/advisories/unreviewed/2022/04/GHSA-qgjc-6844-xqv9/GHSA-qgjc-6844-xqv9.json +++ b/advisories/unreviewed/2022/04/GHSA-qgjc-6844-xqv9/GHSA-qgjc-6844-xqv9.json @@ -7,12 +7,8 @@ "CVE-2004-2657" ], "details": "** DISPUTED ** Mozilla Firefox 1.5.0.1, and possibly other versions, preserves some records of user activity even after uninstalling, which allows local users who share a Windows profile to view the records after a new installation of Firefox, as reported for the list of Passwords Never Saved web sites. NOTE: The vendor has disputed this issue, stating that \"The uninstaller is primarily there to uninstall the application. It is not there to uninstall user data. For the moment I will stick by my module-owner decision.\"", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -36,9 +32,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/04/GHSA-r2gf-vgv9-wfwv/GHSA-r2gf-vgv9-wfwv.json b/advisories/unreviewed/2022/04/GHSA-r2gf-vgv9-wfwv/GHSA-r2gf-vgv9-wfwv.json index 76f0039f281..8d7bae317c8 100644 --- a/advisories/unreviewed/2022/04/GHSA-r2gf-vgv9-wfwv/GHSA-r2gf-vgv9-wfwv.json +++ b/advisories/unreviewed/2022/04/GHSA-r2gf-vgv9-wfwv/GHSA-r2gf-vgv9-wfwv.json @@ -7,12 +7,8 @@ "CVE-2004-2343" ], "details": "** DISPUTED ** Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -36,9 +32,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/04/GHSA-vgx4-x9cv-rgq3/GHSA-vgx4-x9cv-rgq3.json b/advisories/unreviewed/2022/04/GHSA-vgx4-x9cv-rgq3/GHSA-vgx4-x9cv-rgq3.json index fb2bf10b7f7..069009d380e 100644 --- a/advisories/unreviewed/2022/04/GHSA-vgx4-x9cv-rgq3/GHSA-vgx4-x9cv-rgq3.json +++ b/advisories/unreviewed/2022/04/GHSA-vgx4-x9cv-rgq3/GHSA-vgx4-x9cv-rgq3.json @@ -7,12 +7,8 @@ "CVE-2004-2238" ], "details": "** DISPUTED ** Format string vulnerability in vsybase.c in vpopmail 5.4.2 and earlier has unknown impact and attack vectors. NOTE: in a followup post, it was observed that the source code used constants that, when compiled, became static format strings. Thus this is not a vulnerability.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -44,9 +40,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/04/GHSA-wm9h-x535-wxff/GHSA-wm9h-x535-wxff.json b/advisories/unreviewed/2022/04/GHSA-wm9h-x535-wxff/GHSA-wm9h-x535-wxff.json index a1934847030..9af8d0fed1c 100644 --- a/advisories/unreviewed/2022/04/GHSA-wm9h-x535-wxff/GHSA-wm9h-x535-wxff.json +++ b/advisories/unreviewed/2022/04/GHSA-wm9h-x535-wxff/GHSA-wm9h-x535-wxff.json @@ -7,12 +7,8 @@ "CVE-2004-0091" ], "details": "** DISPUTED ** NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in register.php for unknown versions of vBulletin allows remote attackers to inject arbitrary HTML or web script via the reg_site (or possibly regsite) parameter. NOTE: the vendor has disputed this issue, saying \"There is no hidden field called 'reg_site', nor any $reg_site variable anywhere in the vBulletin 2 or vBulletin 3 source code or templates, nor has it ever existed. We can only assume that this vulnerability was found in a site running code modified from that supplied by Jelsoft.\"", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -40,9 +36,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/04/GHSA-xc5f-pfpm-hrw6/GHSA-xc5f-pfpm-hrw6.json b/advisories/unreviewed/2022/04/GHSA-xc5f-pfpm-hrw6/GHSA-xc5f-pfpm-hrw6.json index 8336406e0f7..7db0e926278 100644 --- a/advisories/unreviewed/2022/04/GHSA-xc5f-pfpm-hrw6/GHSA-xc5f-pfpm-hrw6.json +++ b/advisories/unreviewed/2022/04/GHSA-xc5f-pfpm-hrw6/GHSA-xc5f-pfpm-hrw6.json @@ -7,12 +7,8 @@ "CVE-2003-0249" ], "details": "** DISPUTED ** PHP treats unknown methods such as \"PoSt\" as a GET request, which could allow attackers to intended access restrictions if PHP is running on a server that passes on all methods, such as Apache httpd 2.0, as demonstrated using a Limit directive. NOTE: this issue has been disputed by the Apache security team, saying \"It is by design that PHP allows scripts to process any request method. A script which does not explicitly verify the request method will hence be processed as normal for arbitrary methods. It is therefore expected behaviour that one cannot implement per-method access control using the Apache configuration alone, which is the assumption made in this report.\"", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-224m-5fj7-xcf7/GHSA-224m-5fj7-xcf7.json b/advisories/unreviewed/2022/05/GHSA-224m-5fj7-xcf7/GHSA-224m-5fj7-xcf7.json index e77f6cf6689..2d4d5ae3f44 100644 --- a/advisories/unreviewed/2022/05/GHSA-224m-5fj7-xcf7/GHSA-224m-5fj7-xcf7.json +++ b/advisories/unreviewed/2022/05/GHSA-224m-5fj7-xcf7/GHSA-224m-5fj7-xcf7.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -31,9 +29,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-227r-cc3q-mh85/GHSA-227r-cc3q-mh85.json b/advisories/unreviewed/2022/05/GHSA-227r-cc3q-mh85/GHSA-227r-cc3q-mh85.json index bcd6c2b86c7..a634771374d 100644 --- a/advisories/unreviewed/2022/05/GHSA-227r-cc3q-mh85/GHSA-227r-cc3q-mh85.json +++ b/advisories/unreviewed/2022/05/GHSA-227r-cc3q-mh85/GHSA-227r-cc3q-mh85.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -31,9 +29,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-22pm-jxcw-xcx5/GHSA-22pm-jxcw-xcx5.json b/advisories/unreviewed/2022/05/GHSA-22pm-jxcw-xcx5/GHSA-22pm-jxcw-xcx5.json index cb8e7c341db..e25a4e38c02 100644 --- a/advisories/unreviewed/2022/05/GHSA-22pm-jxcw-xcx5/GHSA-22pm-jxcw-xcx5.json +++ b/advisories/unreviewed/2022/05/GHSA-22pm-jxcw-xcx5/GHSA-22pm-jxcw-xcx5.json @@ -7,12 +7,8 @@ "CVE-2019-5264" ], "details": "There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition. Successful exploit could cause information disclosure.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-23gg-c2jg-23p5/GHSA-23gg-c2jg-23p5.json b/advisories/unreviewed/2022/05/GHSA-23gg-c2jg-23p5/GHSA-23gg-c2jg-23p5.json index 1e65689d0bd..2d27e6554c8 100644 --- a/advisories/unreviewed/2022/05/GHSA-23gg-c2jg-23p5/GHSA-23gg-c2jg-23p5.json +++ b/advisories/unreviewed/2022/05/GHSA-23gg-c2jg-23p5/GHSA-23gg-c2jg-23p5.json @@ -7,12 +7,8 @@ "CVE-2007-2412" ], "details": "** DISPUTED ** Directory traversal vulnerability in modules/file.php in Seir Anphin allows remote attackers to obtain sensitive information via a .. (dot dot) in the a[filepath] parameter. NOTE: a third party has disputed this issue because the a array is populated by a database query before use.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -36,9 +32,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-2438-c5fw-q6wq/GHSA-2438-c5fw-q6wq.json b/advisories/unreviewed/2022/05/GHSA-2438-c5fw-q6wq/GHSA-2438-c5fw-q6wq.json index aa726ca0b0b..ea72a93bf5f 100644 --- a/advisories/unreviewed/2022/05/GHSA-2438-c5fw-q6wq/GHSA-2438-c5fw-q6wq.json +++ b/advisories/unreviewed/2022/05/GHSA-2438-c5fw-q6wq/GHSA-2438-c5fw-q6wq.json @@ -7,12 +7,8 @@ "CVE-2007-2311" ], "details": "** DISPUTED ** PHP remote file inclusion vulnerability in install/index.php in BlooFoxCMS 0.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the content_php parameter. NOTE: this issue has been disputed by a reliable third party, stating that content_php is initialized before use.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -36,9 +32,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-26hx-v824-3wvf/GHSA-26hx-v824-3wvf.json b/advisories/unreviewed/2022/05/GHSA-26hx-v824-3wvf/GHSA-26hx-v824-3wvf.json index 8ed10b73419..d661aaa6a4c 100644 --- a/advisories/unreviewed/2022/05/GHSA-26hx-v824-3wvf/GHSA-26hx-v824-3wvf.json +++ b/advisories/unreviewed/2022/05/GHSA-26hx-v824-3wvf/GHSA-26hx-v824-3wvf.json @@ -7,12 +7,8 @@ "CVE-2007-3463" ], "details": "** DISPUTED ** Microsoft Windows XP SP2 allows local users, who have sessions created by another user's RunAs (run as) command, to kill arbitrary processes of this other user, as demonstrated by the taskkill program. NOTE: the researcher claims a vendor dispute in which the vendor states that \"RunAs and UAC are convenience features, not security boundaries. If you need a security guarantee, please log out and log back in with a different account.\"", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -32,9 +28,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-28fh-3r6h-cgpw/GHSA-28fh-3r6h-cgpw.json b/advisories/unreviewed/2022/05/GHSA-28fh-3r6h-cgpw/GHSA-28fh-3r6h-cgpw.json index dd498979f8f..64932c32512 100644 --- a/advisories/unreviewed/2022/05/GHSA-28fh-3r6h-cgpw/GHSA-28fh-3r6h-cgpw.json +++ b/advisories/unreviewed/2022/05/GHSA-28fh-3r6h-cgpw/GHSA-28fh-3r6h-cgpw.json @@ -7,12 +7,8 @@ "CVE-2019-1462" ], "details": "A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka 'Microsoft PowerPoint Remote Code Execution Vulnerability'.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,9 +24,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-2988-2x63-c565/GHSA-2988-2x63-c565.json b/advisories/unreviewed/2022/05/GHSA-2988-2x63-c565/GHSA-2988-2x63-c565.json index 4da70e81338..d56b821e3a4 100644 --- a/advisories/unreviewed/2022/05/GHSA-2988-2x63-c565/GHSA-2988-2x63-c565.json +++ b/advisories/unreviewed/2022/05/GHSA-2988-2x63-c565/GHSA-2988-2x63-c565.json @@ -7,12 +7,8 @@ "CVE-2006-1651" ], "details": "** DISPUTED ** Microsoft ISA Server 2004 allows remote attackers to bypass certain filtering rules, including ones for (1) ICMP and (2) TCP, via IPv6 packets. NOTE: An established researcher has disputed this issue, saying that \"Neither ISA Server 2004 nor Windows 2003 Basic Firewall support IPv6 filtering ... This is different network protocol.\"", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -36,9 +32,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-2f5j-prvf-gf42/GHSA-2f5j-prvf-gf42.json b/advisories/unreviewed/2022/05/GHSA-2f5j-prvf-gf42/GHSA-2f5j-prvf-gf42.json index 63ca9f251bd..5acbf4beb5f 100644 --- a/advisories/unreviewed/2022/05/GHSA-2f5j-prvf-gf42/GHSA-2f5j-prvf-gf42.json +++ b/advisories/unreviewed/2022/05/GHSA-2f5j-prvf-gf42/GHSA-2f5j-prvf-gf42.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-2g43-m4mx-mjqr/GHSA-2g43-m4mx-mjqr.json b/advisories/unreviewed/2022/05/GHSA-2g43-m4mx-mjqr/GHSA-2g43-m4mx-mjqr.json index 7fac7aa9556..923413ee090 100644 --- a/advisories/unreviewed/2022/05/GHSA-2g43-m4mx-mjqr/GHSA-2g43-m4mx-mjqr.json +++ b/advisories/unreviewed/2022/05/GHSA-2g43-m4mx-mjqr/GHSA-2g43-m4mx-mjqr.json @@ -7,12 +7,8 @@ "CVE-2019-10607" ], "details": "Out of bounds memcpy can occur by providing the embedded NULL character string and length greater than the actual string length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9615, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8996, MSM8996AU, QCA4531, QCA8081, QCA9531, QCA9558, QCA9886, QCA9980, QCN7605, QCS605, SDA660, SDX20, SDX24, SDX55, SM8150, SXR1130", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-2gpc-wgcp-jq34/GHSA-2gpc-wgcp-jq34.json b/advisories/unreviewed/2022/05/GHSA-2gpc-wgcp-jq34/GHSA-2gpc-wgcp-jq34.json index 3a795bd142b..62b45ec3f44 100644 --- a/advisories/unreviewed/2022/05/GHSA-2gpc-wgcp-jq34/GHSA-2gpc-wgcp-jq34.json +++ b/advisories/unreviewed/2022/05/GHSA-2gpc-wgcp-jq34/GHSA-2gpc-wgcp-jq34.json @@ -7,12 +7,8 @@ "CVE-2006-2191" ], "details": "** DISPUTED ** Format string vulnerability in Mailman before 2.1.9 allows attackers to execute arbitrary code via unspecified vectors. NOTE: the vendor has disputed this vulnerability, stating that it is \"unexploitable.\"", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -40,9 +36,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-2j3g-cq99-w5x4/GHSA-2j3g-cq99-w5x4.json b/advisories/unreviewed/2022/05/GHSA-2j3g-cq99-w5x4/GHSA-2j3g-cq99-w5x4.json index 867be140840..324da6cc9ea 100644 --- a/advisories/unreviewed/2022/05/GHSA-2j3g-cq99-w5x4/GHSA-2j3g-cq99-w5x4.json +++ b/advisories/unreviewed/2022/05/GHSA-2j3g-cq99-w5x4/GHSA-2j3g-cq99-w5x4.json @@ -7,12 +7,8 @@ "CVE-2006-3850" ], "details": "** DISPUTED ** PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to execute arbitrary PHP code via a URL in the RootDirectory parameter. NOTE: this issue has been disputed by a third party who states that the RootDirectory parameter is initialized before being used, for version 1.0. CVE analysis concurs with the dispute, but it is unclear whether older versions are affected.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -52,9 +48,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-2m88-ww7m-8xfj/GHSA-2m88-ww7m-8xfj.json b/advisories/unreviewed/2022/05/GHSA-2m88-ww7m-8xfj/GHSA-2m88-ww7m-8xfj.json index c6ac67e3465..f25a6fcda7d 100644 --- a/advisories/unreviewed/2022/05/GHSA-2m88-ww7m-8xfj/GHSA-2m88-ww7m-8xfj.json +++ b/advisories/unreviewed/2022/05/GHSA-2m88-ww7m-8xfj/GHSA-2m88-ww7m-8xfj.json @@ -7,12 +7,8 @@ "CVE-2019-18571" ], "details": "The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a reflected cross-site scripting vulnerability in the My Access Live module [MAL]. An authenticated malicious local user could potentially exploit this vulnerability by sending crafted URL with scripts. When victim users access the module through their browsers, the malicious code gets injected and executed by the web browser in the context of the vulnerable web application.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,9 +24,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-2p8c-2cmg-p6f8/GHSA-2p8c-2cmg-p6f8.json b/advisories/unreviewed/2022/05/GHSA-2p8c-2cmg-p6f8/GHSA-2p8c-2cmg-p6f8.json index 91fdb3868c8..ab23b9fec00 100644 --- a/advisories/unreviewed/2022/05/GHSA-2p8c-2cmg-p6f8/GHSA-2p8c-2cmg-p6f8.json +++ b/advisories/unreviewed/2022/05/GHSA-2p8c-2cmg-p6f8/GHSA-2p8c-2cmg-p6f8.json @@ -7,12 +7,8 @@ "CVE-2019-15011" ], "details": "The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclosed application link information to non-admin users via a missing permissions check.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-2r75-g6rg-pq2m/GHSA-2r75-g6rg-pq2m.json b/advisories/unreviewed/2022/05/GHSA-2r75-g6rg-pq2m/GHSA-2r75-g6rg-pq2m.json index 388d3f0430d..2823bd97f25 100644 --- a/advisories/unreviewed/2022/05/GHSA-2r75-g6rg-pq2m/GHSA-2r75-g6rg-pq2m.json +++ b/advisories/unreviewed/2022/05/GHSA-2r75-g6rg-pq2m/GHSA-2r75-g6rg-pq2m.json @@ -7,12 +7,8 @@ "CVE-2007-1924" ], "details": "** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in phpContact allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to (1) contact_business.php or (2) contact_person.php. NOTE: this issue is disputed by CVE and a reliable third party, because include_path is initialized to a fixed value before use.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -32,9 +28,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-2whm-2v6j-6238/GHSA-2whm-2v6j-6238.json b/advisories/unreviewed/2022/05/GHSA-2whm-2v6j-6238/GHSA-2whm-2v6j-6238.json index 7d5a6d5604c..159f80d74f1 100644 --- a/advisories/unreviewed/2022/05/GHSA-2whm-2v6j-6238/GHSA-2whm-2v6j-6238.json +++ b/advisories/unreviewed/2022/05/GHSA-2whm-2v6j-6238/GHSA-2whm-2v6j-6238.json @@ -7,12 +7,8 @@ "CVE-2019-11104" ], "details": "Insufficient input validation in MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an authenticated user to potentially enable escalation of privilege via local access.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-3346-hwjm-fgpv/GHSA-3346-hwjm-fgpv.json b/advisories/unreviewed/2022/05/GHSA-3346-hwjm-fgpv/GHSA-3346-hwjm-fgpv.json index 88460fb7b24..7adb8a4e127 100644 --- a/advisories/unreviewed/2022/05/GHSA-3346-hwjm-fgpv/GHSA-3346-hwjm-fgpv.json +++ b/advisories/unreviewed/2022/05/GHSA-3346-hwjm-fgpv/GHSA-3346-hwjm-fgpv.json @@ -7,12 +7,8 @@ "CVE-2019-11096" ], "details": "Insufficient memory protection for Intel(R) Ethernet I218 Adapter driver for Windows* 10 before version 24.1 may allow an authenticated user to potentially enable information disclosure via local access.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-33p3-36hv-c9p7/GHSA-33p3-36hv-c9p7.json b/advisories/unreviewed/2022/05/GHSA-33p3-36hv-c9p7/GHSA-33p3-36hv-c9p7.json index 88b4cfbb64b..b03c3806be4 100644 --- a/advisories/unreviewed/2022/05/GHSA-33p3-36hv-c9p7/GHSA-33p3-36hv-c9p7.json +++ b/advisories/unreviewed/2022/05/GHSA-33p3-36hv-c9p7/GHSA-33p3-36hv-c9p7.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -31,9 +29,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-36c4-mfgf-7fg3/GHSA-36c4-mfgf-7fg3.json b/advisories/unreviewed/2022/05/GHSA-36c4-mfgf-7fg3/GHSA-36c4-mfgf-7fg3.json index f4455f5469c..5f58223d4ba 100644 --- a/advisories/unreviewed/2022/05/GHSA-36c4-mfgf-7fg3/GHSA-36c4-mfgf-7fg3.json +++ b/advisories/unreviewed/2022/05/GHSA-36c4-mfgf-7fg3/GHSA-36c4-mfgf-7fg3.json @@ -7,12 +7,8 @@ "CVE-2019-1480" ], "details": "An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Media Player Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1481.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,9 +24,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-38wm-mhwf-wxxg/GHSA-38wm-mhwf-wxxg.json b/advisories/unreviewed/2022/05/GHSA-38wm-mhwf-wxxg/GHSA-38wm-mhwf-wxxg.json index 25a31920845..5bd59fbb682 100644 --- a/advisories/unreviewed/2022/05/GHSA-38wm-mhwf-wxxg/GHSA-38wm-mhwf-wxxg.json +++ b/advisories/unreviewed/2022/05/GHSA-38wm-mhwf-wxxg/GHSA-38wm-mhwf-wxxg.json @@ -7,12 +7,8 @@ "CVE-2019-1468" ], "details": "A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote Code Execution Vulnerability'.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,9 +24,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-38wr-g9xc-v3j7/GHSA-38wr-g9xc-v3j7.json b/advisories/unreviewed/2022/05/GHSA-38wr-g9xc-v3j7/GHSA-38wr-g9xc-v3j7.json index 36332a78d56..0383875ad02 100644 --- a/advisories/unreviewed/2022/05/GHSA-38wr-g9xc-v3j7/GHSA-38wr-g9xc-v3j7.json +++ b/advisories/unreviewed/2022/05/GHSA-38wr-g9xc-v3j7/GHSA-38wr-g9xc-v3j7.json @@ -7,12 +7,8 @@ "CVE-2007-1972" ], "details": "** DISPUTED ** PatrolAgent.exe in BMC Performance Manager does not require authentication for requests to modify configuration files, which allows remote attackers to execute arbitrary code via a request on TCP port 3181 for modification of the masterAgentName and masterAgentStartLine SNMP parameters. NOTE: the vendor disputes this vulnerability, stating that it does not exist when the system is properly configured.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -48,9 +44,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-3fj2-qcp9-8293/GHSA-3fj2-qcp9-8293.json b/advisories/unreviewed/2022/05/GHSA-3fj2-qcp9-8293/GHSA-3fj2-qcp9-8293.json index 9b61b354003..062414aa7b3 100644 --- a/advisories/unreviewed/2022/05/GHSA-3fj2-qcp9-8293/GHSA-3fj2-qcp9-8293.json +++ b/advisories/unreviewed/2022/05/GHSA-3fj2-qcp9-8293/GHSA-3fj2-qcp9-8293.json @@ -7,12 +7,8 @@ "CVE-2019-18579" ], "details": "Settings for the Dell XPS 13 2-in-1 (7390) BIOS versions prior to 1.1.3 contain a configuration vulnerability. The BIOS configuration for the \"Enable Thunderbolt (and PCIe behind TBT) pre-boot modules\" setting is enabled by default. A local unauthenticated attacker with physical access to a user's system can obtain read or write access to main memory via a DMA attack during platform boot.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-3g7w-2hm5-mfrj/GHSA-3g7w-2hm5-mfrj.json b/advisories/unreviewed/2022/05/GHSA-3g7w-2hm5-mfrj/GHSA-3g7w-2hm5-mfrj.json index 64b0fd7fd00..3d4589434fe 100644 --- a/advisories/unreviewed/2022/05/GHSA-3g7w-2hm5-mfrj/GHSA-3g7w-2hm5-mfrj.json +++ b/advisories/unreviewed/2022/05/GHSA-3g7w-2hm5-mfrj/GHSA-3g7w-2hm5-mfrj.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-3h7g-j24x-p7v7/GHSA-3h7g-j24x-p7v7.json b/advisories/unreviewed/2022/05/GHSA-3h7g-j24x-p7v7/GHSA-3h7g-j24x-p7v7.json index a7a2bd84ac0..d77350fefaf 100644 --- a/advisories/unreviewed/2022/05/GHSA-3h7g-j24x-p7v7/GHSA-3h7g-j24x-p7v7.json +++ b/advisories/unreviewed/2022/05/GHSA-3h7g-j24x-p7v7/GHSA-3h7g-j24x-p7v7.json @@ -7,12 +7,8 @@ "CVE-2007-0253" ], "details": "** DISPUTED ** Unspecified vulnerability in the grsecurity patch has unspecified impact and remote attack vectors, a different vulnerability than the expand_stack vulnerability from the Digital Armaments 20070110 pre-advisory. NOTE: the grsecurity developer has disputed this issue, stating that \"the function they claim the vulnerability to be in is a trivial function, which can, and has been, easily checked for any supposed vulnerabilities.\" The developer also cites a past disclosure that was not proven.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -32,9 +28,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-3j3j-42qg-7vjj/GHSA-3j3j-42qg-7vjj.json b/advisories/unreviewed/2022/05/GHSA-3j3j-42qg-7vjj/GHSA-3j3j-42qg-7vjj.json index 672e9aaae1d..3e48f146fad 100644 --- a/advisories/unreviewed/2022/05/GHSA-3j3j-42qg-7vjj/GHSA-3j3j-42qg-7vjj.json +++ b/advisories/unreviewed/2022/05/GHSA-3j3j-42qg-7vjj/GHSA-3j3j-42qg-7vjj.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -31,9 +29,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-3j5x-4pxv-4c48/GHSA-3j5x-4pxv-4c48.json b/advisories/unreviewed/2022/05/GHSA-3j5x-4pxv-4c48/GHSA-3j5x-4pxv-4c48.json index d384e1aa1e1..e99b65c653b 100644 --- a/advisories/unreviewed/2022/05/GHSA-3j5x-4pxv-4c48/GHSA-3j5x-4pxv-4c48.json +++ b/advisories/unreviewed/2022/05/GHSA-3j5x-4pxv-4c48/GHSA-3j5x-4pxv-4c48.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -31,9 +29,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-3m8h-6gm5-g2hj/GHSA-3m8h-6gm5-g2hj.json b/advisories/unreviewed/2022/05/GHSA-3m8h-6gm5-g2hj/GHSA-3m8h-6gm5-g2hj.json index d9fe0bdcd5e..c8bb7582ee7 100644 --- a/advisories/unreviewed/2022/05/GHSA-3m8h-6gm5-g2hj/GHSA-3m8h-6gm5-g2hj.json +++ b/advisories/unreviewed/2022/05/GHSA-3m8h-6gm5-g2hj/GHSA-3m8h-6gm5-g2hj.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -31,9 +29,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-3mq6-q8x8-h9pp/GHSA-3mq6-q8x8-h9pp.json b/advisories/unreviewed/2022/05/GHSA-3mq6-q8x8-h9pp/GHSA-3mq6-q8x8-h9pp.json index 4676aa36edd..6f2c2c89bbe 100644 --- a/advisories/unreviewed/2022/05/GHSA-3mq6-q8x8-h9pp/GHSA-3mq6-q8x8-h9pp.json +++ b/advisories/unreviewed/2022/05/GHSA-3mq6-q8x8-h9pp/GHSA-3mq6-q8x8-h9pp.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -31,9 +29,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-3vg8-xc35-38qf/GHSA-3vg8-xc35-38qf.json b/advisories/unreviewed/2022/05/GHSA-3vg8-xc35-38qf/GHSA-3vg8-xc35-38qf.json index 88769bfa6d9..f3ecbb118b8 100644 --- a/advisories/unreviewed/2022/05/GHSA-3vg8-xc35-38qf/GHSA-3vg8-xc35-38qf.json +++ b/advisories/unreviewed/2022/05/GHSA-3vg8-xc35-38qf/GHSA-3vg8-xc35-38qf.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-3w7x-89vw-qj79/GHSA-3w7x-89vw-qj79.json b/advisories/unreviewed/2022/05/GHSA-3w7x-89vw-qj79/GHSA-3w7x-89vw-qj79.json index f144e6c76ec..c387f29c0d2 100644 --- a/advisories/unreviewed/2022/05/GHSA-3w7x-89vw-qj79/GHSA-3w7x-89vw-qj79.json +++ b/advisories/unreviewed/2022/05/GHSA-3w7x-89vw-qj79/GHSA-3w7x-89vw-qj79.json @@ -7,12 +7,8 @@ "CVE-2006-2827" ], "details": "** DISPUTED ** SQL injection vulnerability in search.php in X-Cart Gold and Pro 4.0.18, and X-Cart 4.1.0 beta 1, allows remote attackers to execute arbitrary SQL commands via the \"Search for pattern\" field, when the settings specify only \"Search in Detailed description\" and \"Search also in ISBN.\" NOTE: the vendor disputed this issue in a comment on the original researcher's blog, saying \"the bug does not impose any security threat and remote attackers can't add, modify, or delete information in the back-end database by sending specially-crafted SQL statements to the search.php script using various search parameters.\" As of 20060605, the original blog entry is unavailable, although ISS also reports the same dispute. CVE has not been able to investigate this issue further, although the researcher sometimes makes inaccurate claims.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -32,9 +28,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-3w89-xp68-5ffh/GHSA-3w89-xp68-5ffh.json b/advisories/unreviewed/2022/05/GHSA-3w89-xp68-5ffh/GHSA-3w89-xp68-5ffh.json index 585a9312463..5d32b18d798 100644 --- a/advisories/unreviewed/2022/05/GHSA-3w89-xp68-5ffh/GHSA-3w89-xp68-5ffh.json +++ b/advisories/unreviewed/2022/05/GHSA-3w89-xp68-5ffh/GHSA-3w89-xp68-5ffh.json @@ -7,12 +7,8 @@ "CVE-2019-1453" ], "details": "A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability'.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-3wxw-q9mc-652q/GHSA-3wxw-q9mc-652q.json b/advisories/unreviewed/2022/05/GHSA-3wxw-q9mc-652q/GHSA-3wxw-q9mc-652q.json index 160b521869c..385e2161421 100644 --- a/advisories/unreviewed/2022/05/GHSA-3wxw-q9mc-652q/GHSA-3wxw-q9mc-652q.json +++ b/advisories/unreviewed/2022/05/GHSA-3wxw-q9mc-652q/GHSA-3wxw-q9mc-652q.json @@ -7,12 +7,8 @@ "CVE-2019-11992" ], "details": "A security vulnerability in HPE OneView for VMware vCenter 9.5 could be exploited remotely to allow Cross-Site Scripting.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-3xxg-cfxh-f9rh/GHSA-3xxg-cfxh-f9rh.json b/advisories/unreviewed/2022/05/GHSA-3xxg-cfxh-f9rh/GHSA-3xxg-cfxh-f9rh.json index e70c673fe4f..dc094b128e4 100644 --- a/advisories/unreviewed/2022/05/GHSA-3xxg-cfxh-f9rh/GHSA-3xxg-cfxh-f9rh.json +++ b/advisories/unreviewed/2022/05/GHSA-3xxg-cfxh-f9rh/GHSA-3xxg-cfxh-f9rh.json @@ -7,12 +7,8 @@ "CVE-2006-1096" ], "details": "** DISPUTED ** Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -40,9 +36,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-42gq-6jpg-qgvv/GHSA-42gq-6jpg-qgvv.json b/advisories/unreviewed/2022/05/GHSA-42gq-6jpg-qgvv/GHSA-42gq-6jpg-qgvv.json index c20db41cd9b..2ee60497d10 100644 --- a/advisories/unreviewed/2022/05/GHSA-42gq-6jpg-qgvv/GHSA-42gq-6jpg-qgvv.json +++ b/advisories/unreviewed/2022/05/GHSA-42gq-6jpg-qgvv/GHSA-42gq-6jpg-qgvv.json @@ -7,12 +7,8 @@ "CVE-2016-1000108" ], "details": "yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -36,9 +32,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-444h-f6gh-4x6h/GHSA-444h-f6gh-4x6h.json b/advisories/unreviewed/2022/05/GHSA-444h-f6gh-4x6h/GHSA-444h-f6gh-4x6h.json index 129e1de3b5f..46d8ad96d33 100644 --- a/advisories/unreviewed/2022/05/GHSA-444h-f6gh-4x6h/GHSA-444h-f6gh-4x6h.json +++ b/advisories/unreviewed/2022/05/GHSA-444h-f6gh-4x6h/GHSA-444h-f6gh-4x6h.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -39,9 +37,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-44hj-4cvh-q8j8/GHSA-44hj-4cvh-q8j8.json b/advisories/unreviewed/2022/05/GHSA-44hj-4cvh-q8j8/GHSA-44hj-4cvh-q8j8.json index 77191bbc8e4..6777f0c9b87 100644 --- a/advisories/unreviewed/2022/05/GHSA-44hj-4cvh-q8j8/GHSA-44hj-4cvh-q8j8.json +++ b/advisories/unreviewed/2022/05/GHSA-44hj-4cvh-q8j8/GHSA-44hj-4cvh-q8j8.json @@ -7,12 +7,8 @@ "CVE-2019-11103" ], "details": "Insufficient input validation in firmware update software for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow an authenticated user to potentially enable escalation of privilege via local access.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-44j4-r5c9-5x3w/GHSA-44j4-r5c9-5x3w.json b/advisories/unreviewed/2022/05/GHSA-44j4-r5c9-5x3w/GHSA-44j4-r5c9-5x3w.json index 1f21816724a..901c24a6265 100644 --- a/advisories/unreviewed/2022/05/GHSA-44j4-r5c9-5x3w/GHSA-44j4-r5c9-5x3w.json +++ b/advisories/unreviewed/2022/05/GHSA-44j4-r5c9-5x3w/GHSA-44j4-r5c9-5x3w.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-47j6-w2j2-7jxf/GHSA-47j6-w2j2-7jxf.json b/advisories/unreviewed/2022/05/GHSA-47j6-w2j2-7jxf/GHSA-47j6-w2j2-7jxf.json index 3b1e3752dd0..f19adb72029 100644 --- a/advisories/unreviewed/2022/05/GHSA-47j6-w2j2-7jxf/GHSA-47j6-w2j2-7jxf.json +++ b/advisories/unreviewed/2022/05/GHSA-47j6-w2j2-7jxf/GHSA-47j6-w2j2-7jxf.json @@ -17,9 +17,7 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-48f5-m6h3-fv56/GHSA-48f5-m6h3-fv56.json b/advisories/unreviewed/2022/05/GHSA-48f5-m6h3-fv56/GHSA-48f5-m6h3-fv56.json index bd5fb203ca2..e00df470eef 100644 --- a/advisories/unreviewed/2022/05/GHSA-48f5-m6h3-fv56/GHSA-48f5-m6h3-fv56.json +++ b/advisories/unreviewed/2022/05/GHSA-48f5-m6h3-fv56/GHSA-48f5-m6h3-fv56.json @@ -7,12 +7,8 @@ "CVE-2006-3692" ], "details": "** DISPUTED ** PHP remote file inclusion vulnerability in enduser/listmessenger.php in ListMessenger 0.9.3 allows remote attackers to execute arbitrary PHP code via a URL in the lm_path parameter. NOTE: the vendor has disputed this issue to SecurityTracker, stating that the $lm_path variable is set to a constant value. As of 20060726, CVE concurs with the vendor based on SecurityTracker's post-disclosure analysis.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -44,9 +40,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-48xm-vhch-7jrp/GHSA-48xm-vhch-7jrp.json b/advisories/unreviewed/2022/05/GHSA-48xm-vhch-7jrp/GHSA-48xm-vhch-7jrp.json index 161c8b27281..8466e3b7dc4 100644 --- a/advisories/unreviewed/2022/05/GHSA-48xm-vhch-7jrp/GHSA-48xm-vhch-7jrp.json +++ b/advisories/unreviewed/2022/05/GHSA-48xm-vhch-7jrp/GHSA-48xm-vhch-7jrp.json @@ -7,12 +7,8 @@ "CVE-2006-3794" ], "details": "** DISPUTED ** SQL injection vulnerability in Amazing Flash AFCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the search field. NOTE: the vendor has disputed this issue, stating \"if someone were to type in any sql injection code, that code would never be queried.\"", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -48,9 +44,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-495f-rrqv-px5g/GHSA-495f-rrqv-px5g.json b/advisories/unreviewed/2022/05/GHSA-495f-rrqv-px5g/GHSA-495f-rrqv-px5g.json index c2d39a7da14..b796a3b158d 100644 --- a/advisories/unreviewed/2022/05/GHSA-495f-rrqv-px5g/GHSA-495f-rrqv-px5g.json +++ b/advisories/unreviewed/2022/05/GHSA-495f-rrqv-px5g/GHSA-495f-rrqv-px5g.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-49q8-vm9q-8qmp/GHSA-49q8-vm9q-8qmp.json b/advisories/unreviewed/2022/05/GHSA-49q8-vm9q-8qmp/GHSA-49q8-vm9q-8qmp.json index 3d47de43f57..848faa4e401 100644 --- a/advisories/unreviewed/2022/05/GHSA-49q8-vm9q-8qmp/GHSA-49q8-vm9q-8qmp.json +++ b/advisories/unreviewed/2022/05/GHSA-49q8-vm9q-8qmp/GHSA-49q8-vm9q-8qmp.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-4cfg-jrff-x7x9/GHSA-4cfg-jrff-x7x9.json b/advisories/unreviewed/2022/05/GHSA-4cfg-jrff-x7x9/GHSA-4cfg-jrff-x7x9.json index 614fad419f5..3e10055148d 100644 --- a/advisories/unreviewed/2022/05/GHSA-4cfg-jrff-x7x9/GHSA-4cfg-jrff-x7x9.json +++ b/advisories/unreviewed/2022/05/GHSA-4cfg-jrff-x7x9/GHSA-4cfg-jrff-x7x9.json @@ -7,12 +7,8 @@ "CVE-2019-11105" ], "details": "Logic issue in subsystem for Intel(R) CSME before versions 12.0.45, 13.0.10 and 14.0.10 may allow a privileged user to potentially enable escalation of privilege and information disclosure via local access.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-4g2c-wq22-f9v3/GHSA-4g2c-wq22-f9v3.json b/advisories/unreviewed/2022/05/GHSA-4g2c-wq22-f9v3/GHSA-4g2c-wq22-f9v3.json index 41456c69561..cbe53ce3426 100644 --- a/advisories/unreviewed/2022/05/GHSA-4g2c-wq22-f9v3/GHSA-4g2c-wq22-f9v3.json +++ b/advisories/unreviewed/2022/05/GHSA-4g2c-wq22-f9v3/GHSA-4g2c-wq22-f9v3.json @@ -7,12 +7,8 @@ "CVE-2006-1273" ], "details": "** DISPUTED ** Mozilla Firefox 1.0.7 and 1.5.0.1 allows remote attackers to cause a denial of service (crash) via an HTML tag with a large number of script action handlers such as onload and onmouseover, which triggers the crash when the user views the page source. NOTE: Red Hat has disputed this issue, suggesting that \"It is likely the reporter was running the IE Tab extension,\" and Mozilla also confirmed that this is not an issue in Firefox itself.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -36,9 +32,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-4hp3-f9mj-xjxq/GHSA-4hp3-f9mj-xjxq.json b/advisories/unreviewed/2022/05/GHSA-4hp3-f9mj-xjxq/GHSA-4hp3-f9mj-xjxq.json index caa08c78ba7..a821e6f2a70 100644 --- a/advisories/unreviewed/2022/05/GHSA-4hp3-f9mj-xjxq/GHSA-4hp3-f9mj-xjxq.json +++ b/advisories/unreviewed/2022/05/GHSA-4hp3-f9mj-xjxq/GHSA-4hp3-f9mj-xjxq.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -31,9 +29,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-4jv3-78rc-jxj3/GHSA-4jv3-78rc-jxj3.json b/advisories/unreviewed/2022/05/GHSA-4jv3-78rc-jxj3/GHSA-4jv3-78rc-jxj3.json index b58b499d660..2054ae021d4 100644 --- a/advisories/unreviewed/2022/05/GHSA-4jv3-78rc-jxj3/GHSA-4jv3-78rc-jxj3.json +++ b/advisories/unreviewed/2022/05/GHSA-4jv3-78rc-jxj3/GHSA-4jv3-78rc-jxj3.json @@ -7,12 +7,8 @@ "CVE-2007-2084" ], "details": "** DISPUTED ** PHP remote file inclusion vulnerability in MobilePublisherphp 1.1.2 allows remote attackers to execute arbitrary PHP code via a URL in the auth_method parameter to (1) index.php, (2) list.php, (3) postreview.php, (4) reindex.php, (5) sections.php, (6) templates.php, (7) userinfo.php, (8) users.php, and (9) view.php in admin/. NOTE: this issue has been disputed by a reliable third party, who states that $auth_method is defined before use.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-4mmq-7ch6-8958/GHSA-4mmq-7ch6-8958.json b/advisories/unreviewed/2022/05/GHSA-4mmq-7ch6-8958/GHSA-4mmq-7ch6-8958.json index e16f04d014b..31314b22cbb 100644 --- a/advisories/unreviewed/2022/05/GHSA-4mmq-7ch6-8958/GHSA-4mmq-7ch6-8958.json +++ b/advisories/unreviewed/2022/05/GHSA-4mmq-7ch6-8958/GHSA-4mmq-7ch6-8958.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-4q9q-728x-j7v5/GHSA-4q9q-728x-j7v5.json b/advisories/unreviewed/2022/05/GHSA-4q9q-728x-j7v5/GHSA-4q9q-728x-j7v5.json index 1e8e11d62fb..651b67ed968 100644 --- a/advisories/unreviewed/2022/05/GHSA-4q9q-728x-j7v5/GHSA-4q9q-728x-j7v5.json +++ b/advisories/unreviewed/2022/05/GHSA-4q9q-728x-j7v5/GHSA-4q9q-728x-j7v5.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-4qq3-m5jv-mjcc/GHSA-4qq3-m5jv-mjcc.json b/advisories/unreviewed/2022/05/GHSA-4qq3-m5jv-mjcc/GHSA-4qq3-m5jv-mjcc.json index 51e38a8418d..eb164fc1501 100644 --- a/advisories/unreviewed/2022/05/GHSA-4qq3-m5jv-mjcc/GHSA-4qq3-m5jv-mjcc.json +++ b/advisories/unreviewed/2022/05/GHSA-4qq3-m5jv-mjcc/GHSA-4qq3-m5jv-mjcc.json @@ -7,12 +7,8 @@ "CVE-2007-2072" ], "details": "** DISPUTED ** PHP remote file inclusion vulnerability in index.php in Ivan Gallery Script 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: this issue has been disputed by third party researchers for 0.3, stating that the dir variable is properly initialized before use.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -40,9 +36,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-4qrq-ggqj-r6p9/GHSA-4qrq-ggqj-r6p9.json b/advisories/unreviewed/2022/05/GHSA-4qrq-ggqj-r6p9/GHSA-4qrq-ggqj-r6p9.json index 7811ea70b85..25bebe7cf74 100644 --- a/advisories/unreviewed/2022/05/GHSA-4qrq-ggqj-r6p9/GHSA-4qrq-ggqj-r6p9.json +++ b/advisories/unreviewed/2022/05/GHSA-4qrq-ggqj-r6p9/GHSA-4qrq-ggqj-r6p9.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-4qvc-8v32-hq7p/GHSA-4qvc-8v32-hq7p.json b/advisories/unreviewed/2022/05/GHSA-4qvc-8v32-hq7p/GHSA-4qvc-8v32-hq7p.json index e76efeb752d..6237fcc0122 100644 --- a/advisories/unreviewed/2022/05/GHSA-4qvc-8v32-hq7p/GHSA-4qvc-8v32-hq7p.json +++ b/advisories/unreviewed/2022/05/GHSA-4qvc-8v32-hq7p/GHSA-4qvc-8v32-hq7p.json @@ -7,12 +7,8 @@ "CVE-2019-19846" ], "details": "In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-4vj4-4373-qj2m/GHSA-4vj4-4373-qj2m.json b/advisories/unreviewed/2022/05/GHSA-4vj4-4373-qj2m/GHSA-4vj4-4373-qj2m.json index a3e61f6d72d..e6c98227337 100644 --- a/advisories/unreviewed/2022/05/GHSA-4vj4-4373-qj2m/GHSA-4vj4-4373-qj2m.json +++ b/advisories/unreviewed/2022/05/GHSA-4vj4-4373-qj2m/GHSA-4vj4-4373-qj2m.json @@ -7,12 +7,8 @@ "CVE-2007-2422" ], "details": "** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in Modules Builder (modbuild) 4.1 for Comdev One Admin allow remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter to (1) config-bak.php or (2) config.php. NOTE: CVE disputes this vulnerability because the unmodified scripts set the applicable variable to the empty string; reasonable modified copies would use a fixed pathname string.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -32,9 +28,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-4w5w-4c66-6rx9/GHSA-4w5w-4c66-6rx9.json b/advisories/unreviewed/2022/05/GHSA-4w5w-4c66-6rx9/GHSA-4w5w-4c66-6rx9.json index a846e051978..04a050cc358 100644 --- a/advisories/unreviewed/2022/05/GHSA-4w5w-4c66-6rx9/GHSA-4w5w-4c66-6rx9.json +++ b/advisories/unreviewed/2022/05/GHSA-4w5w-4c66-6rx9/GHSA-4w5w-4c66-6rx9.json @@ -7,12 +7,8 @@ "CVE-2019-0402" ], "details": "SAP Adaptive Server Enterprise, before versions 15.7 and 16.0, under certain conditions exposes some sensitive information to the admin, leading to Information Disclosure.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,9 +24,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-4wv4-xcmf-c3qh/GHSA-4wv4-xcmf-c3qh.json b/advisories/unreviewed/2022/05/GHSA-4wv4-xcmf-c3qh/GHSA-4wv4-xcmf-c3qh.json index a132ebd1643..a90483ea240 100644 --- a/advisories/unreviewed/2022/05/GHSA-4wv4-xcmf-c3qh/GHSA-4wv4-xcmf-c3qh.json +++ b/advisories/unreviewed/2022/05/GHSA-4wv4-xcmf-c3qh/GHSA-4wv4-xcmf-c3qh.json @@ -7,12 +7,8 @@ "CVE-2019-4388" ], "details": "HCL AppScan Source 9.0.3.13 and earlier is susceptible to cross-site scripting (XSS) attacks by allowing users to embed arbitrary JavaScript code in the Web UI.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-4xrm-v4gp-f34w/GHSA-4xrm-v4gp-f34w.json b/advisories/unreviewed/2022/05/GHSA-4xrm-v4gp-f34w/GHSA-4xrm-v4gp-f34w.json index 8a2a6e12963..448b9ec07ce 100644 --- a/advisories/unreviewed/2022/05/GHSA-4xrm-v4gp-f34w/GHSA-4xrm-v4gp-f34w.json +++ b/advisories/unreviewed/2022/05/GHSA-4xrm-v4gp-f34w/GHSA-4xrm-v4gp-f34w.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -31,9 +29,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/05/GHSA-537p-c499-jvx4/GHSA-537p-c499-jvx4.json b/advisories/unreviewed/2022/05/GHSA-537p-c499-jvx4/GHSA-537p-c499-jvx4.json index 15570e25e3b..29bb08041c6 100644 --- a/advisories/unreviewed/2022/05/GHSA-537p-c499-jvx4/GHSA-537p-c499-jvx4.json +++ b/advisories/unreviewed/2022/05/GHSA-537p-c499-jvx4/GHSA-537p-c499-jvx4.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-544h-mc2x-69r5/GHSA-544h-mc2x-69r5.json b/advisories/unreviewed/2022/05/GHSA-544h-mc2x-69r5/GHSA-544h-mc2x-69r5.json index 5edb9e9321c..cbe0558076f 100644 --- a/advisories/unreviewed/2022/05/GHSA-544h-mc2x-69r5/GHSA-544h-mc2x-69r5.json +++ b/advisories/unreviewed/2022/05/GHSA-544h-mc2x-69r5/GHSA-544h-mc2x-69r5.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-549v-j953-7rc4/GHSA-549v-j953-7rc4.json b/advisories/unreviewed/2022/05/GHSA-549v-j953-7rc4/GHSA-549v-j953-7rc4.json index d8201893c54..2a77af4b8c1 100644 --- a/advisories/unreviewed/2022/05/GHSA-549v-j953-7rc4/GHSA-549v-j953-7rc4.json +++ b/advisories/unreviewed/2022/05/GHSA-549v-j953-7rc4/GHSA-549v-j953-7rc4.json @@ -7,12 +7,8 @@ "CVE-2005-1682" ], "details": "** DISPUTED ** JavaMail API, as used by Solstice Internet Mail Server POP3 2.0, does not properly validate the message number in the MimeMessage constructor in javax.mail.internet.InternetHeaders, which allows remote authenticated users to read other users' e-mail messages by modifying the msgno parameter. NOTE: Sun disputes this issue, stating \"The report makes references to source code and files that do not exist in the mentioned products.\"", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/05/GHSA-55ff-j47x-6xcq/GHSA-55ff-j47x-6xcq.json b/advisories/unreviewed/2022/05/GHSA-55ff-j47x-6xcq/GHSA-55ff-j47x-6xcq.json index 63250116499..8477ac6205f 100644 --- a/advisories/unreviewed/2022/05/GHSA-55ff-j47x-6xcq/GHSA-55ff-j47x-6xcq.json +++ b/advisories/unreviewed/2022/05/GHSA-55ff-j47x-6xcq/GHSA-55ff-j47x-6xcq.json @@ -7,12 +7,8 @@ "CVE-2019-15575" ], "details": "A command injection exists in GitLab CE/EE