Skip to content

Commit 4fb6ec5

Browse files
Samk1710Samk1710
committed
Update License Expression and Sample Test Data
Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>
1 parent 8b21b2f commit 4fb6ec5

File tree

4 files changed

+179
-94
lines changed

4 files changed

+179
-94
lines changed

‎vulnerabilities/pipelines/v2_importers/euvd_importer.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ class EUVDImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
3535
"""
3636

3737
pipeline_id = "euvd_importer_v2"
38-
spdx_license_expression = "LicenseRef-scancode-other-permissive"
38+
spdx_license_expression = "CC-BY-4.0"
3939
license_url = "https://www.enisa.europa.eu/about-enisa/legal-notice/"
4040
url = "https://euvdservices.enisa.europa.eu/api/search"
4141

‎vulnerabilities/tests/test_data/euvd/euvd-expected.json‎

Lines changed: 84 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,157 +1,188 @@
11
[
22
{
3-
"advisory_id": "EUVD-2025-197757",
3+
"advisory_id": "EUVD-2022-0569",
44
"aliases": [
5-
"EUVD-2025-197757",
6-
"CVE-2025-13284"
5+
"EUVD-2022-0569",
6+
"CVE-2018-1109",
7+
"GHSA-cwfw-4gq5-mrqx"
78
],
8-
"summary": "ThinPLUS vulnerability that allows remote code execution",
9+
"summary": "A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.",
910
"affected_packages": [],
1011
"references_v2": [
1112
{
1213
"reference_id": "",
1314
"reference_type": "",
14-
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13284"
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1109"
1516
},
1617
{
1718
"reference_id": "",
1819
"reference_type": "",
19-
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-197757"
20+
"url": "https://github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451"
21+
},
22+
{
23+
"reference_id": "",
24+
"reference_type": "",
25+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547272"
26+
},
27+
{
28+
"reference_id": "",
29+
"reference_type": "",
30+
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0569"
2031
}
2132
],
2233
"severities": [
2334
{
2435
"system": "cvssv3.1",
25-
"value": "9.8",
26-
"scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
36+
"value": "5.3",
37+
"scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
2738
}
2839
],
29-
"date_published": "2025-01-09T01:00:00+00:00",
40+
"date_published": "2021-03-30T01:52:55+00:00",
3041
"weaknesses": [],
31-
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-197757"
42+
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0569"
3243
},
3344
{
34-
"advisory_id": "EUVD-2024-123456",
45+
"advisory_id": "EUVD-2025-199883",
3546
"aliases": [
36-
"EUVD-2024-123456",
37-
"CVE-2024-12345",
38-
"CVE-2024-67890"
47+
"EUVD-2025-199883",
48+
"CVE-2025-66027"
3949
],
40-
"summary": "Multiple vulnerabilities in authentication system",
50+
"summary": "Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users' personal information. This issue has been patched in version 4.5.6.",
4151
"affected_packages": [],
4252
"references_v2": [
4353
{
4454
"reference_id": "",
4555
"reference_type": "",
46-
"url": "https://example.com/advisory1"
56+
"url": "https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg"
4757
},
4858
{
4959
"reference_id": "",
5060
"reference_type": "",
51-
"url": "https://example.com/advisory2"
61+
"url": "https://github.com/lukevella/rallly/commit/59738c04f9a8ec25f0af5ce20ad0eab6cf134963"
5262
},
5363
{
5464
"reference_id": "",
5565
"reference_type": "",
56-
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-123456"
66+
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199883"
5767
}
5868
],
5969
"severities": [
6070
{
61-
"system": "cvssv3.1",
62-
"value": "7.5",
63-
"scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
71+
"system": "cvssv4",
72+
"value": "7.1",
73+
"scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N"
6474
}
6575
],
66-
"date_published": "2024-12-15T10:30:00+00:00",
76+
"date_published": "2025-11-29T00:43:02+00:00",
6777
"weaknesses": [],
68-
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-123456"
78+
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199883"
6979
},
7080
{
71-
"advisory_id": "EUVD-2023-999999",
81+
"advisory_id": "EUVD-2025-199882",
7282
"aliases": [
73-
"EUVD-2023-999999",
74-
"CVE-2023-99999"
83+
"EUVD-2025-199882",
84+
"CVE-2025-66034"
7585
],
76-
"summary": "Denial of service vulnerability",
86+
"summary": "fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib, used by the fonttools varLib CLI and any code that invokes fontTools.varLib.main(). This issue has been patched in version 4.60.2.",
7787
"affected_packages": [],
7888
"references_v2": [
7989
{
8090
"reference_id": "",
8191
"reference_type": "",
82-
"url": "https://security.example.org/2023-999999"
92+
"url": "https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fv"
8393
},
8494
{
8595
"reference_id": "",
8696
"reference_type": "",
87-
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-999999"
97+
"url": "https://github.com/fonttools/fonttools/commit/a696d5ba93270d5954f98e7cab5ddca8a02c1e32"
98+
},
99+
{
100+
"reference_id": "",
101+
"reference_type": "",
102+
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199882"
88103
}
89104
],
90105
"severities": [
91106
{
92-
"system": "cvssv3",
93-
"value": "5.3",
94-
"scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
107+
"system": "cvssv3.1",
108+
"value": "6.3",
109+
"scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L"
95110
}
96111
],
97-
"date_published": "2023-06-20T14:22:00+00:00",
112+
"date_published": "2025-11-29T01:07:12+00:00",
98113
"weaknesses": [],
99-
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-999999"
114+
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199882"
100115
},
101116
{
102-
"advisory_id": "EUVD-2022-555555",
117+
"advisory_id": "EUVD-2025-199921",
103118
"aliases": [
104-
"EUVD-2022-555555",
105-
"CVE-2022-55555"
119+
"EUVD-2025-199921",
120+
"CVE-2025-66420"
106121
],
107-
"summary": "",
122+
"summary": "Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.",
108123
"affected_packages": [],
109124
"references_v2": [
110125
{
111126
"reference_id": "",
112127
"reference_type": "",
113-
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-555555"
128+
"url": "https://discuss.tryton.org/t/security-release-for-issue-14290/8895"
129+
},
130+
{
131+
"reference_id": "",
132+
"reference_type": "",
133+
"url": "https://foss.heptapod.net/tryton/tryton/-/issues/14290"
134+
},
135+
{
136+
"reference_id": "",
137+
"reference_type": "",
138+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66420"
139+
},
140+
{
141+
"reference_id": "",
142+
"reference_type": "",
143+
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199921"
114144
}
115145
],
116146
"severities": [
117147
{
118-
"system": "cvssv2",
119-
"value": "4.3",
120-
"scoring_elements": "AV:N/AC:M/Au:N/C:N/I:P/A:N"
148+
"system": "cvssv3.1",
149+
"value": "5.4",
150+
"scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
121151
}
122152
],
123-
"date_published": "2022-03-10T08:15:00+00:00",
153+
"date_published": "2025-11-30T00:00:00+00:00",
124154
"weaknesses": [],
125-
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-555555"
155+
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199921"
126156
},
127157
{
128-
"advisory_id": "EUVD-2021-111111",
158+
"advisory_id": "EUVD-2025-199889",
129159
"aliases": [
130-
"EUVD-2021-111111"
160+
"EUVD-2025-199889",
161+
"CVE-2025-66036"
131162
],
132-
"summary": "Advisory without CVE alias but with EUVD ID",
163+
"summary": "Retro is an online platform providing items of vintage collections. Prior to version 2.4.7, Retro is vulnerable to a cross-site scripting (XSS) in the input handling component. This issue has been patched in version 2.4.7.",
133164
"affected_packages": [],
134165
"references_v2": [
135166
{
136167
"reference_id": "",
137168
"reference_type": "",
138-
"url": "https://euvd.example.org/2021-111111"
169+
"url": "https://github.com/Anjaliavv51/Retro/security/advisories/GHSA-gvv6-p6h6-2vj2"
139170
},
140171
{
141172
"reference_id": "",
142173
"reference_type": "",
143-
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-111111"
174+
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199889"
144175
}
145176
],
146177
"severities": [
147178
{
148179
"system": "cvssv3.1",
149-
"value": "6.5",
150-
"scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
180+
"value": "6.1",
181+
"scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
151182
}
152183
],
153-
"date_published": "2021-11-05T16:45:00+00:00",
184+
"date_published": "2025-11-29T01:14:38+00:00",
154185
"weaknesses": [],
155-
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-111111"
186+
"url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199889"
156187
}
157188
]

‎vulnerabilities/tests/test_data/euvd/euvd_sample1.json‎

Lines changed: 36 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,47 @@
11
{
22
"items": [
33
{
4-
"id": "EUVD-2025-197757",
5-
"aliases": "CVE-2025-13284",
6-
"description": "ThinPLUS vulnerability that allows remote code execution",
7-
"datePublished": "2025-01-09T01:00:00.000Z",
8-
"baseScore": "9.8",
4+
"id": "EUVD-2022-0569",
5+
"enisaUuid": "ff8d275e-fded-32e0-b1dd-74cbae780c34",
6+
"description": "A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.",
7+
"datePublished": "Mar 30, 2021, 1:52:55 AM",
8+
"dateUpdated": "Dec 1, 2025, 2:18:10 PM",
9+
"baseScore": 5.3,
910
"baseScoreVersion": "3.1",
10-
"baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
11-
"references": "https://nvd.nist.gov/vuln/detail/CVE-2025-13284"
11+
"baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
12+
"references": "https://nvd.nist.gov/vuln/detail/CVE-2018-1109\nhttps://github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1547272\n",
13+
"aliases": "CVE-2018-1109\nGHSA-cwfw-4gq5-mrqx\n",
14+
"assigner": "redhat",
15+
"epss": 0.27
1216
},
1317
{
14-
"id": "EUVD-2024-123456",
15-
"aliases": "CVE-2024-12345\nCVE-2024-67890",
16-
"description": "Multiple vulnerabilities in authentication system",
17-
"datePublished": "2024-12-15T10:30:00.000Z",
18-
"baseScore": "7.5",
19-
"baseScoreVersion": "3.1",
20-
"baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
21-
"references": "https://example.com/advisory1\nhttps://example.com/advisory2"
18+
"id": "EUVD-2025-199883",
19+
"enisaUuid": "227b1294-1b89-32c6-acd8-2cc50af9ea1c",
20+
"description": "Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users' personal information. This issue has been patched in version 4.5.6.",
21+
"datePublished": "Nov 29, 2025, 12:43:02 AM",
22+
"dateUpdated": "Dec 1, 2025, 2:11:22 PM",
23+
"baseScore": 7.1,
24+
"baseScoreVersion": "4.0",
25+
"baseScoreVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
26+
"references": "https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg\nhttps://github.com/lukevella/rallly/commit/59738c04f9a8ec25f0af5ce20ad0eab6cf134963\n",
27+
"aliases": "CVE-2025-66027\n",
28+
"assigner": "GitHub_M",
29+
"epss": 0.04
2230
},
2331
{
24-
"id": "EUVD-2023-999999",
25-
"aliases": "CVE-2023-99999",
26-
"description": "Denial of service vulnerability",
27-
"datePublished": "2023-06-20T14:22:00.000Z",
28-
"baseScore": "5.3",
29-
"baseScoreVersion": "3.0",
30-
"baseScoreVector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
31-
"references": "https://security.example.org/2023-999999"
32+
"id": "EUVD-2025-199882",
33+
"enisaUuid": "911c0f6a-52a9-3013-a8e2-50ff32772b3f",
34+
"description": "fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib, used by the fonttools varLib CLI and any code that invokes fontTools.varLib.main(). This issue has been patched in version 4.60.2.",
35+
"datePublished": "Nov 29, 2025, 1:07:12 AM",
36+
"dateUpdated": "Dec 1, 2025, 2:11:17 PM",
37+
"baseScore": 6.3,
38+
"baseScoreVersion": "3.1",
39+
"baseScoreVector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L",
40+
"references": "https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fv\nhttps://github.com/fonttools/fonttools/commit/a696d5ba93270d5954f98e7cab5ddca8a02c1e32\n",
41+
"aliases": "CVE-2025-66034\n",
42+
"assigner": "GitHub_M",
43+
"epss": 0.09
3244
}
3345
],
34-
"total": 200
46+
"total": 452826
3547
}

0 commit comments

Comments
 (0)