Updated advisory posts against rubysec/ruby-advisory-db@0af3fe2

Author: jasnow

advisories/_posts/2024-10-23-CVE-2024-48652.md

@@ -8,22 +8,28 @@ advisory:
   gem: camaleon_cms
   cve: 2024-48652
   ghsa: hhxg-rvc9-8726
-  url: https://github.com/paragbagul111/CVE-2024-48652
+  url: https://nvd.nist.gov/vuln/detail/CVE-2024-48652
   title: camaleon_cms affected by cross site scripting
   date: 2024-10-23
   description: |-
     Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows
     remote attacker to execute arbitrary code via the content group
     name field.
   cvss_v3: 4.8
-  cvss_v4: 4.8
-  notes: |
-    Never patched
-
-    Unclear if versions 2.8.0 to 2.8.3 patch this vulnerability.
+  patched_versions:
+  - ">= 2.8.0"
   related:
     url:
     - https://nvd.nist.gov/vuln/detail/CVE-2024-48652
+    - https://rubygems.org/gems/camaleon_cms/versions/2.8.0
+    - https://github.com/owen2345/camaleon-cms/releases/tag/2.8.0
+    - https://github.com/owen2345/camaleon-cms/blob/master/CHANGELOG.md#280-2024-07-26
+    - https://github.com/owen2345/camaleon-cms/compare/2.7.5...2.8.0
+    - https://github.com/owen2345/camaleon-cms/pull/1075/changes/1de553b759fde08f7b31ef97d41982d47ec3de94
+    - https://github.com/owen2345/camaleon-cms/pull/1075
     - https://github.com/paragbagul111/CVE-2024-48652
     - https://github.com/advisories/GHSA-hhxg-rvc9-8726
+  notes: |
+    - cvss_v3 from nvd.nist.gov URL
+    - PR#1075 mentions "content groups"
 ---

advisories/_posts/2026-06-12-CVE-2026-10715.md

@@ -0,0 +1,37 @@
+---
+layout: advisory
+title: 'CVE-2026-10715 (camaleon_cms): Camaleon CMS 2.9.2 contains an improper authorization'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  cve: 2026-10715
+  ghsa: vg43-9r8m-q2cc
+  url: https://nvd.nist.gov/vuln/detail/CVE-2026-10715
+  title: Camaleon CMS 2.9.2 contains an improper authorization
+  date: 2026-06-12
+  description: |-
+    Camaleon CMS 2.9.2 contains an improper authorization vulnerability
+    in the administrator draft autosave endpoint. A low-privileged
+    authenticated user can send an arbitrary post_id to
+    POST /admin/post_type/<POST_TYPE_ID>/drafts and overwrite
+    the draft associated with another user's post.
+  cvss_v4: 5.1
+  unaffected_versions:
+  - "< 2.9.2"
+  patched_versions:
+  - ">= 2.9.3"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-10715
+    - https://rubygems.org/gems/camaleon_cms/versions/2.9.3
+    - https://github.com/owen2345/camaleon-cms/releases/tag/2.9.3
+    - https://github.com/owen2345/camaleon-cms/pull/1196
+    - https://fluidattacks.com/es/advisories/billie
+    - https://github.com/advisories/GHSA-vg43-9r8m-q2cc
+  notes: |
+    - cvss_v4 from nvd.nist.gov and GHSA URLs.
+    - Found PR#1196 in release URL.
+    - GHSA is unreviewed.
+---