Publish Advisories

GHSA-2pwh-52h7-7j84
GHSA-g8ph-74m6-8m7r
GHSA-3p77-wg4c-qm24
GHSA-wc6f-qjxc-622v

Author: advisory-database[bot]

advisories/github-reviewed/2021/04/GHSA-2pwh-52h7-7j84/GHSA-2pwh-52h7-7j84.json

@@ -1,12 +1,19 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2pwh-52h7-7j84",
-  "modified": "2021-04-13T17:35:23Z",
+  "modified": "2026-01-22T20:36:39Z",
   "published": "2021-04-16T19:52:49Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2024-0758"
+  ],
   "summary": "JavaScript execution via malicious molfiles (XSS)",
   "details": "### Impact\nThe viewer plugin implementation of `<mol:molecule>` renders molfile data directly inside a `<script>` tag without any escaping. Arbitrary JavaScript code can thus be executed in the client browser via crafted molfiles.\n\n### Patches\nPatched in v0.3.0: Molfile data is now rendered as value of a hidden `<input>` tag and escaped via JSF's mechanisms.\n\n### Workarounds\nNo workaround available.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
   "affected": [
     {
       "package": {
@@ -32,6 +39,18 @@
     {
       "type": "WEB",
       "url": "https://github.com/ipb-halle/MolecularFaces/security/advisories/GHSA-2pwh-52h7-7j84"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0758"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/ipb-halle/MolecularFaces"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-2pwh-52h7-7j84"
     }
   ],
   "database_specific": {

advisories/github-reviewed/2023/05/GHSA-g8ph-74m6-8m7r/GHSA-g8ph-74m6-8m7r.json

@@ -1,11 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-g8ph-74m6-8m7r",
-  "modified": "2023-05-12T20:18:51Z",
+  "modified": "2026-01-22T20:36:14Z",
   "published": "2023-05-12T20:18:51Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2024-23689"
+  ],
   "summary": "ClickHouse vulnerable to client certificate password exposure in client exception",
-  "details": "### Summary\nAs initially reported in issue #1331, when client certificate authentication is enabled with password protection, the password (referred to as the client option `sslkey`) may be exposed in client exceptions (e.g., ClickHouseException or SQLException). This vulnerability can potentially lead to unauthorized access, data breaches, and violations of user privacy.\n\n### Details\nDuring the handling of ClickHouseException, the client certificate password may be inadvertently exposed when sslkey is specified. This issue can arise when an exception is thrown during the execution of a query or a database operation. The client certificate password is then included in the exception message, which could be logged or exposed to unauthorized parties.\n\n### Impact\nThis vulnerability enables an attacker with access to client exception error messages or logs to obtain client certificate passwords, potentially allowing unauthorized access to sensitive information, data manipulation, and denial of service attacks. The extent of the risk depends on the specific implementation and usage of the affected systems. However, any exposure of client certificate passwords should be treated as a high-priority security concern.\n",
+  "details": "### Summary\nAs initially reported in issue #1331, when client certificate authentication is enabled with password protection, the password (referred to as the client option `sslkey`) may be exposed in client exceptions (e.g., ClickHouseException or SQLException). This vulnerability can potentially lead to unauthorized access, data breaches, and violations of user privacy.\n\n### Details\nDuring the handling of ClickHouseException, the client certificate password may be inadvertently exposed when sslkey is specified. This issue can arise when an exception is thrown during the execution of a query or a database operation. The client certificate password is then included in the exception message, which could be logged or exposed to unauthorized parties.\n\n### Impact\nThis vulnerability enables an attacker with access to client exception error messages or logs to obtain client certificate passwords, potentially allowing unauthorized access to sensitive information, data manipulation, and denial of service attacks. The extent of the risk depends on the specific implementation and usage of the affected systems. However, any exposure of client certificate passwords should be treated as a high-priority security concern.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -76,6 +78,10 @@
       "type": "WEB",
       "url": "https://github.com/ClickHouse/clickhouse-java/security/advisories/GHSA-g8ph-74m6-8m7r"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23689"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/ClickHouse/clickhouse-java/issues/1331"
@@ -91,10 +97,16 @@
     {
       "type": "WEB",
       "url": "https://github.com/ClickHouse/clickhouse-java/releases/tag/v0.4.6"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-g8ph-74m6-8m7r"
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-209"
+    ],
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2023-05-12T20:18:51Z",

advisories/github-reviewed/2024/01/GHSA-3p77-wg4c-qm24/GHSA-3p77-wg4c-qm24.json

@@ -1,13 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3p77-wg4c-qm24",
-  "modified": "2025-05-30T16:31:28Z",
+  "modified": "2026-01-22T20:36:05Z",
   "published": "2024-01-19T21:30:36Z",
-  "aliases": [
-    "CVE-2024-23689"
-  ],
-  "summary": "Exposure of sensitive information in ClickHouse",
-  "details": "Exposure of sensitive information in exceptions in ClickHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.",
+  "withdrawn": "2026-01-22T20:36:05Z",
+  "aliases": [],
+  "summary": "Duplicate Advisory: Exposure of sensitive information in ClickHouse",
+  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-g8ph-74m6-8m7r. This link is maintained to preserve external references.\n\n## Original Description\nExposure of sensitive information in exceptions in ClickHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.",
   "severity": [
     {
       "type": "CVSS_V3",

advisories/github-reviewed/2024/01/GHSA-wc6f-qjxc-622v/GHSA-wc6f-qjxc-622v.json

@@ -1,13 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-wc6f-qjxc-622v",
-  "modified": "2024-01-26T19:58:37Z",
+  "modified": "2026-01-22T20:36:31Z",
   "published": "2024-01-19T21:30:36Z",
-  "aliases": [
-    "CVE-2024-0758"
-  ],
-  "summary": "JavaScript execution via malicious molfiles (XSS)",
-  "details": "MolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can execute arbitrary JavaScript in the context of a victim browser via crafted molfiles.\n\n\n",
+  "withdrawn": "2026-01-22T20:36:31Z",
+  "aliases": [],
+  "summary": "Duplicate Advisory: JavaScript execution via malicious molfiles (XSS)",
+  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-2pwh-52h7-7j84. This link is maintained to preserve external references.\n\n## Original Description\nMolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can execute arbitrary JavaScript in the context of a victim browser via crafted molfiles.",
   "severity": [
     {
       "type": "CVSS_V3",