netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-01-09 18:31:45 +00:00
parent a099aa8c4c
commit 06dcdcd0cd
88 changed files with 2444 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-gqhm-4h93-rrhg/GHSA-gqhm-4h93-rrhg.json
+96
View File
@@ -0,0 +1,96 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gqhm-4h93-rrhg",
"modified": "2024-01-09T18:30:37Z",
"published": "2022-05-13T01:48:40Z",
"aliases": [
"CVE-2018-1000866"
],
"summary": "Jenkins Script Security and Pipeline Groovy Plugins Sandbox Bypass",
"details": "A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins.workflow:workflow-cps"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.60"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:script-security"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.48"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000866"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/script-security-plugin/commit/16c862ae9d4038a3edbd8bdfb0fd1401a509d56b"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/workflow-cps-plugin/commit/0eb89aaf24065dbbdf6db84516ac1a52cd435e6d"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/workflow-cps-plugin/commit/e1c56eb6d85d513cb24dfe188e6f592d0ff84b38"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2019:0326"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2019:0327"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2018-10-29/#SECURITY-1186"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-01-09T18:30:37Z",
"nvd_published_at": "2018-12-10T14:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-gqhm-4h93-rrhg/GHSA-gqhm-4h93-rrhg.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gqhm-4h93-rrhg",
"modified": "2022-05-13T01:48:40Z",
"published": "2022-05-13T01:48:40Z",
"aliases": [
"CVE-2018-1000866"
],
"details": "A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000866"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2019:0326"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2019:0327"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2018-10-29/#SECURITY-1186"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-10T14:29:00Z"
}
}
advisories/unreviewed/2023/12/GHSA-29hx-4x6h-2q4x/GHSA-29hx-4x6h-2q4x.json
+8
View File
@@ -25,10 +25,18 @@
"type": "WEB",
"url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html"
},
{
"type": "WEB",
"url": "https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices"
},
{
"type": "WEB",
"url": "https://modzero.com/en/advisories/mz-23-01-poly-voip-devices/"
},
{
"type": "WEB",
"url": "https://modzero.com/en/advisories/mz-23-01-poly-voip/"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.249260"
advisories/unreviewed/2023/12/GHSA-38xw-jx8m-w5wp/GHSA-38xw-jx8m-w5wp.json
+8
View File
@@ -25,10 +25,18 @@
"type": "WEB",
"url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html"
},
{
"type": "WEB",
"url": "https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices"
},
{
"type": "WEB",
"url": "https://modzero.com/en/advisories/mz-23-01-poly-voip-devices/"
},
{
"type": "WEB",
"url": "https://modzero.com/en/advisories/mz-23-01-poly-voip/"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.249259"
advisories/unreviewed/2023/12/GHSA-53qp-xq7m-xppp/GHSA-53qp-xq7m-xppp.json
+12
View File
@@ -25,14 +25,26 @@
"type": "WEB",
"url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html"
},
{
"type": "WEB",
"url": "https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices"
},
{
"type": "WEB",
"url": "https://modzero.com/en/advisories/mz-23-01-poly-voip-devices/"
},
{
"type": "WEB",
"url": "https://modzero.com/en/advisories/mz-23-01-poly-voip/"
},
{
"type": "WEB",
"url": "https://modzero.com/en/blog/multiple-vulnerabilities-in-poly-products/"
},
{
"type": "WEB",
"url": "https://support.hp.com/us-en/document/ish_9929296-9929329-16/hpsbpy03896"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.249255"
advisories/unreviewed/2023/12/GHSA-g8c7-p5fx-vxh6/GHSA-g8c7-p5fx-vxh6.json
+8
View File
@@ -25,10 +25,18 @@
"type": "WEB",
"url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html"
},
{
"type": "WEB",
"url": "https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices"
},
{
"type": "WEB",
"url": "https://modzero.com/en/advisories/mz-23-01-poly-voip-devices/"
},
{
"type": "WEB",
"url": "https://modzero.com/en/advisories/mz-23-01-poly-voip/"
},
{
"type": "WEB",
"url": "https://modzero.com/en/blog/multiple-vulnerabilities-in-poly-products/"
advisories/unreviewed/2023/12/GHSA-hpp6-2prw-cvwr/GHSA-hpp6-2prw-cvwr.json
+12
View File
@@ -25,10 +25,22 @@
"type": "WEB",
"url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html"
},
{
"type": "WEB",
"url": "https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices"
},
{
"type": "WEB",
"url": "https://modzero.com/en/advisories/mz-23-01-poly-voip-devices/"
},
{
"type": "WEB",
"url": "https://modzero.com/en/advisories/mz-23-01-poly-voip/"
},
{
"type": "WEB",
"url": "https://support.hp.com/us-en/document/ish_9929371-9929407-16/hpsbpy03899"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.249258"
advisories/unreviewed/2023/12/GHSA-rfg4-wjmf-xghf/GHSA-rfg4-wjmf-xghf.json
+12
View File
@@ -25,10 +25,22 @@
"type": "WEB",
"url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html"
},
{
"type": "WEB",
"url": "https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices"
},
{
"type": "WEB",
"url": "https://modzero.com/en/advisories/mz-23-01-poly-voip-devices/"
},
{
"type": "WEB",
"url": "https://modzero.com/en/advisories/mz-23-01-poly-voip/"
},
{
"type": "WEB",
"url": "https://support.hp.com/us-en/document/ish_9931565-9931594-16/hpsbpy03898"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.249257"
advisories/unreviewed/2023/12/GHSA-rv87-xrcf-5c22/GHSA-rv87-xrcf-5c22.json
+12
View File
@@ -25,14 +25,26 @@
"type": "WEB",
"url": "https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html"
},
{
"type": "WEB",
"url": "https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices"
},
{
"type": "WEB",
"url": "https://modzero.com/en/advisories/mz-23-01-poly-voip-devices/"
},
{
"type": "WEB",
"url": "https://modzero.com/en/advisories/mz-23-01-poly-voip/"
},
{
"type": "WEB",
"url": "https://modzero.com/en/blog/multiple-vulnerabilities-in-poly-products/"
},
{
"type": "WEB",
"url": "https://support.hp.com/us-en/document/ish_9929447-9929472-16/hpsbpy03902"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.249261"
advisories/unreviewed/2023/12/GHSA-xgc4-wqm7-7qrj/GHSA-xgc4-wqm7-7qrj.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xgc4-wqm7-7qrj",
"modified": "2023-12-22T03:30:33Z",
"modified": "2024-01-09T18:30:26Z",
"published": "2023-12-22T03:30:33Z",
"aliases": [
"CVE-2023-51708"
],
"details": "Bentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via a crafted request, leading to information disclosure. This affects eB System management Console before 23.00.02.03 and Assetwise ALIM For Transportation before 23.00.01.25.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-22T02:15:43Z"
advisories/unreviewed/2024/01/GHSA-2f47-rm5c-8fr9/GHSA-2f47-rm5c-8fr9.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2f47-rm5c-8fr9",
"modified": "2024-01-02T21:30:25Z",
"modified": "2024-01-09T18:30:26Z",
"published": "2024-01-02T21:30:25Z",
"aliases": [
"CVE-2023-48419"
advisories/unreviewed/2024/01/GHSA-2w87-fjj9-j39h/GHSA-2w87-fjj9-j39h.json
+4
View File
@@ -29,6 +29,10 @@
"type": "WEB",
"url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Jan/3"
advisories/unreviewed/2024/01/GHSA-34wv-gh47-86r8/GHSA-34wv-gh47-86r8.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-34wv-gh47-86r8",
"modified": "2024-01-09T18:30:28Z",
"published": "2024-01-09T18:30:28Z",
"aliases": [
"CVE-2024-20666"
],
"details": "BitLocker Security Feature Bypass Vulnerability",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20666"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20666"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-09T18:15:50Z"
}
}
advisories/unreviewed/2024/01/GHSA-37gw-25xx-74f7/GHSA-37gw-25xx-74f7.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-37gw-25xx-74f7",
"modified": "2024-01-09T18:30:28Z",
"published": "2024-01-09T18:30:28Z",
"aliases": [
"CVE-2024-20674"
],
"details": "Windows Kerberos Security Feature Bypass Vulnerability",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20674"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20674"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-09T18:15:50Z"
}
}
advisories/unreviewed/2024/01/GHSA-3mhh-fjjv-vfrh/GHSA-3mhh-fjjv-vfrh.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3mhh-fjjv-vfrh",
"modified": "2024-01-09T18:30:28Z",
"published": "2024-01-09T18:30:28Z",
"aliases": [
"CVE-2024-20676"
],
"details": "Azure Storage Mover Remote Code Execution Vulnerability",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20676"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20676"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-09T18:15:50Z"
}
}
advisories/unreviewed/2024/01/GHSA-3p2x-fgmw-32pv/GHSA-3p2x-fgmw-32pv.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3p2x-fgmw-32pv",
"modified": "2024-01-09T18:30:28Z",
"published": "2024-01-09T18:30:28Z",
"aliases": [
"CVE-2024-20681"
],
"details": "Windows Subsystem for Linux Elevation of Privilege Vulnerability",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20681"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20681"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-09T18:15:51Z"
}
}
advisories/unreviewed/2024/01/GHSA-3pg3-7f5j-x2m5/GHSA-3pg3-7f5j-x2m5.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3pg3-7f5j-x2m5",
"modified": "2024-01-09T18:30:29Z",
"published": "2024-01-09T18:30:29Z",
"aliases": [
"CVE-2024-21318"
],
"details": "Microsoft SharePoint Server Remote Code Execution Vulnerability",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21318"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21318"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-09T18:15:55Z"
}
}
advisories/unreviewed/2024/01/GHSA-3qxp-wv2v-jfc4/GHSA-3qxp-wv2v-jfc4.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3qxp-wv2v-jfc4",
"modified": "2024-01-09T18:30:29Z",
"published": "2024-01-09T18:30:29Z",
"aliases": [
"CVE-2024-21312"
],
"details": ".NET Framework Denial of Service Vulnerability",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21312"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21312"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-09T18:15:55Z"
}
}
advisories/unreviewed/2024/01/GHSA-3vm6-qcr3-wwv3/GHSA-3vm6-qcr3-wwv3.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3vm6-qcr3-wwv3",
"modified": "2024-01-03T00:30:24Z",
"modified": "2024-01-09T18:30:26Z",
"published": "2024-01-03T00:30:24Z",
"aliases": [
"CVE-2023-49555"
],
"details": "An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_smacro function in the modules/preprocs/nasm/nasm-pp.c component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-03T00:15:09Z"
advisories/unreviewed/2024/01/GHSA-4p4p-22cr-2gqw/GHSA-4p4p-22cr-2gqw.json
+4
View File
@@ -29,6 +29,10 @@
"type": "WEB",
"url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Jan/3"

Some files were not shown because too many files have changed in this diff Show More