Map OSVDB advisories to CVE records

gems/handlebars-source/OSVDB-131671.yml → gems/handlebars-source/CVE-2015-8861.yml

@@ -1,7 +1,9 @@
 ---
 gem: handlebars-source
 osvdb: 131671
-url: https://security.snyk.io/vuln/SNYK-RUBY-HANDLEBARSSOURCE-20238
+cve: 2015-8861
+ghsa: 9prh-257w-9277
+url: https://github.com/advisories/GHSA-9prh-257w-9277
 title: handlebars.js - quoteless attributes in templates can lead to XSS
 date: 2015-08-24
 description: |
@@ -16,9 +18,9 @@ description: |
 patched_versions:
   - ">= 4.0.0"
 related:
-  ghsa:
-    - 9prh-257w-9277
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-8861
+    - https://github.com/advisories/GHSA-9prh-257w-9277
     - https://github.com/handlebars-lang/handlebars.js
     - https://github.com/handlebars-lang/handlebars.js/compare/v3.0.8...v4.0.0
     - https://security.snyk.io/vuln/SNYK-RUBY-HANDLEBARSSOURCE-20238

gems/mustache-js-rails/OSVDB-131671.yml → gems/mustache-js-rails/CVE-2015-8862.yml

@@ -1,7 +1,9 @@
 ---
 gem: mustache-js-rails
 osvdb: 131671
-url: https://security.snyk.io/vuln/SNYK-RUBY-MUSTACHEJSRAILS-20242
+cve: 2015-8862
+ghsa: w3w8-37jv-2c58
+url: https://github.com/advisories/GHSA-w3w8-37jv-2c58
 title: mustache.js - quoteless attributes in templates can lead to XSS
 date: 2015-11-17
 description: |
@@ -16,9 +18,9 @@ description: |
 patched_versions:
   - ">= 2.0.3"
 related:
-  ghsa:
-    - w3w8-37jv-2c58
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-8862
+    - https://github.com/advisories/GHSA-w3w8-37jv-2c58
     - https://github.com/janl/mustache.js/pull/530
     - https://security.snyk.io/vuln/SNYK-RUBY-MUSTACHEJSRAILS-20242
     - https://www.veracode.com/blog/research/handlebarsjs-vulnerability-impact-study

gems/spree/CVE-2011-10019.yml

@@ -1,14 +1,15 @@
 ---
 gem: spree
 cve: 2011-10019
+osvdb: 76011
 ghsa: 97vm-c39p-jr86
 url: https://github.com/advisories/GHSA-97vm-c39p-jr86
 title: Remote Command Execution in Spree search functionality
-date: 2011-02-10
+date: 2011-10-05
 description: |
   Spree versions prior to 0.60.2 contain a remote command execution
   vulnerability in the search functionality. The application fails to
-  properly sanitize input passed via the `search[:send][]` parameter,
+  properly sanitize input passed via the `search[send][]` parameter,
   which is dynamically invoked using Ruby’s `send` method. This allows
   attackers to execute arbitrary shell commands on the server without
   authentication.