Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-11-28 05:14:23 +00:00
parent d571115f9d
commit 06fce923af
914 changed files with 1911 additions and 5733 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "Apache Tomcat Denial of Service vulnerability in the Catalina package",
  "details": "The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.6 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -4,9 +4,7 @@
  "modified": "2023-11-08T20:03:29Z",
  "published": "2022-05-24T17:04:00Z",
  "withdrawn": "2023-11-08T19:16:49Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: tree-kill vulnerable to remote code execution",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-884p-74jh-xrg2. Ths link is maintained to preserve external references.\n\n## Original Description\nA Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command, which is executed without any check. The issue arises here: `https://github.com/pkrumins/node-tree-kill/blob/master/index.js#L20` . While the Linux part is sanitized, the Windows on simply uses the `+` operand to concatenate the input into `exec()`\n\n### Steps To Reproduce:\n\nCreate the following PoC file:\n\n```js\n// poc.js\nvar kill = require('tree-kill');\nkill('3333332 & echo \"HACKED\" > HACKED.txt & ');\n```\nExecute the following commands in another terminal:\n\n```bash\nnpm i tree-kill # Install affected module\ndir # Check *HACKED.txt* doesn't exist\nnode poc.js #  Run the PoC\ndir # Now *HACKED.txt* exists :)\n```\n\nA new file called `HACKED.txt` will be created, containing the `HACKED` string.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-9h6h-9g78-86f7",
  "modified": "2022-12-29T01:50:20Z",
  "published": "2022-12-29T01:50:20Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Yapscan's report receiver server vulnerable to path traversal and log injection",
  "details": "### Impact\n\nIf you make use of the **report receiver server** (experimental), a client may be able to forge requests such that arbitrary files on the host can be overwritten (subject to permissions of the yapscan server), leading to loss of data. This is particularly problematic if you do not authenticate clients and/or run the server with elevated permissions.\n\n### Patches\n\nVulnerable versions:\n\n- v0.18.0\n- v0.19.0 (unreleased)\n\nThis problem is patched in version v0.19.1\n\n### Workarounds\n\nUpdate to the newer version is highly encouraged!\n\nMeasures to reduce the risk of this include authenticating clients (see `--client-ca` flag) and containerization of the yapscan server.\n\n### References\n\nThe tracking issue is #35. There you can find the commits, fixing the issue.\n",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-9vx8-f5c4-862x",
  "modified": "2023-03-31T14:27:12Z",
  "published": "2023-02-24T17:39:18Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "XML External Entity (XXE) vulnerability in apoc.import.graphml",
  "details": "### Impact\nA XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was not configured in a secure way and therefore allowed this.\n\nExternal entities can be used to read local files, send HTTP requests, and perform denial-of-service attacks on the application.\n\nAbusing the XXE vulnerability enabled assessors to read local files remotely. Although with the level of privileges assessors had this was limited to one-line files. With the ability to write to the database, any file could have been read. Additionally, assessors noted, with local testing, the server could be crashed by passing in improperly formatted XML. \n\n### Patches\nThe users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability is 4.4.0.14. \n\n### Workarounds\nIf you cannot upgrade the library, you can control the [allowlist](https://neo4j.com/docs/operations-manual/current/reference/configuration-settings/#config_dbms.security.procedures.allowlist)  of the  procedures that can be used in your system.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [neo4j-apoc-procedures](https://github.com/neo4j-contrib/neo4j-apoc-procedures)\n* Email us at [security@neo4j.com](mailto:security@neo4j.com)\n\n### Credits\nWe want to publicly recognise the contribution of Christopher Schneider – State Farm.\n",
  "severity": [
@@ -8,9 +8,7 @@
  ],
  "summary": "Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings",
  "details": "### Impact\nThis vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.\n\n### Patches\nUpdate to version 10.5.20 or apply this patch manually https://github.com/pimcore/pimcore/pull/14721.patch\n\n### Workarounds\nApply patch manually https://github.com/pimcore/pimcore/pull/14721.patch\n\n### References\nhttps://huntr.dev/bounties/d8a47f29-3297-4fce-b534-e1d95a2b3e19\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings",
  "details": "### Impact\nThis vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.\n\n### Patches\nUpdate to version 10.5.20 or apply this patch manually https://github.com/pimcore/pimcore/pull/14721.patch\n\n### Workarounds\nApply https://github.com/pimcore/pimcore/pull/14721.patch manually.\n\n### References\nhttps://huntr.dev/bounties/64f943c4-68e5-4ef8-82f6-9c4abe928256/",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "pimcore is vulnerable to cross-site scripting in translate module",
  "details": "### Impact\nThis vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.\n\n### Patches\nUpdate to version 10.5.20 or apply this patch manually https://github.com/pimcore/pimcore/pull/14732.patch\n\n### Workarounds\nApply https://github.com/pimcore/pimcore/pull/14732.patch manually.\n\n### References\nhttps://huntr.dev/bounties/84419c7b-ae29-401b-bdfd-5d0c498d320f/\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -50,9 +50,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-27T23:51:52Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "h2 vulnerable to denial of service",
  "details": "Hyper is an HTTP library for Rust and h2 is an HTTP 2.0 client & server implementation for Rust. An issue was discovered in h2 v0.2.4 when processing header frames. It incorrectly processes the HTTP2 `RST_STREAM` frames by not always releasing the memory immediately upon receiving the reset frame, leading to stream stacking. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).\n\nThis issue affects users only when dealing with http2 connections.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-fq33-vmhv-48xh",
  "modified": "2023-04-07T19:23:49Z",
  "published": "2023-04-07T19:23:49Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "ntru-rs has unsound FFI: Wrong API usage causes write past allocated area",
  "details": "The following usage causes undefined behavior.\n```rust\nlet kp: ntru::types::KeyPair = …;\nkp.get_public().export(Default::default())\n```\n\nWhen compiled with debug assertions, the code above will trigger a `attempt to subtract with overflow` panic before UB occurs.\nOther mistakes (e.g. using `EncParams` from a different key) may always trigger UB.\n\nLikely, older versions of this crate are also affected, but have not been tested.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -47,9 +43,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-07T19:23:49Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-5cpq-8wj7-hf2v",
  "modified": "2023-06-02T17:13:10Z",
  "published": "2023-06-02T17:13:10Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Vulnerable OpenSSL included in cryptography wheels",
  "details": "pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.5-40.0.2 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://www.openssl.org/news/secadv/20230530.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -54,9 +50,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-02T17:13:10Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-mrr8-v49w-3333",
  "modified": "2023-07-10T19:08:10Z",
  "published": "2023-07-10T19:08:10Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "sweetalert2 v11.6.14 and above contains potentially undesirable behavior",
  "details": "`sweetalert2` versions 11.6.14 and above have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality of the package when run on specific tlds. This functionality is documented on the project's readme",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-9phh-r37v-34wh",
  "modified": "2023-08-14T21:10:17Z",
  "published": "2023-08-14T21:10:17Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files",
  "details": "### Impact\nThe browser renders the resulting HTML when opening a direct link to an HTML file via lakeFS. Any JavaScript within that page is executed within the context of the domain lakeFS is running in.  \nAn attacker can inject a malicious script inline, download resources from another domain, or make arbitrary HTTP requests. This would allow the attacker to send information to a random domain or carry out lakeFS operations while impersonating the victim.  \n\nNote that to carry out this attack, an attacker must already have access to upload the malicious HTML file to one or more repositories. It also depends on the victim receiving and opening the link to the malicious HTML file.\n\n### Patches\nThis is fixed in lakeFS version 0.106.0\n\n### Workarounds\nThere are no known workarounds at this time.\n",
  "severity": [
@@ -54,9 +52,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-14T21:10:17Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-qppv-j76h-2rpx",
  "modified": "2023-08-14T21:34:17Z",
  "published": "2023-08-14T21:34:17Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths",
  "details": "## Summary\nTornado interprets `-`, `+`, and `_` in chunk length and `Content-Length` values, which are not allowed by the HTTP RFCs. This can result in request smuggling when Tornado is deployed behind certain proxies that interpret those non-standard characters differently. This is known to apply to older versions of haproxy, although the current release is not affected.\n\n## Details\nTornado uses the `int` constructor to parse the values of `Content-Length` headers and chunk lengths in the following locations:\n### `tornado/http1connection.py:445`\n```python3\n            self._expected_content_remaining = int(headers[\"Content-Length\"])\n```\n### `tornado/http1connection.py:621`\n```python3\n                content_length = int(headers[\"Content-Length\"])  # type: Optional[int]\n```\n### `tornado/http1connection.py:671`\n```python3\n            chunk_len = int(chunk_len_str.strip(), 16)\n```\nBecause `int(\"0_0\") == int(\"+0\") == int(\"-0\") == int(\"0\")`, using the `int` constructor to parse and validate strings that should contain only ASCII digits is not a good strategy. \n\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-w5vr-6qhr-36cc",
  "modified": "2023-08-14T21:10:29Z",
  "published": "2023-08-14T21:10:29Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "`ed25519-dalek` Double Public Key Signing Function Oracle Attack",
  "details": "Versions of `ed25519-dalek` prior to v2.0 model private and public keys as separate types which can be assembled into a `Keypair`, and also provide APIs for serializing and deserializing 64-byte private/public keypairs.\n\nSuch APIs and serializations are inherently unsafe as the public key is one of the inputs used in the deterministic computation of the `S` part of the signature, but not in the `R` value. An adversary could somehow use the signing function as an oracle that allows arbitrary public keys as input can obtain two signatures for the same message sharing the same `R` and only differ on the `S` part.\n\nUnfortunately, when this happens, one can easily extract the private key.\n\nRevised public APIs in v2.0 of `ed25519-dalek` do NOT allow a decoupled private/public keypair as signing input, except as part of specially labeled \"hazmat\" APIs which are clearly labeled as being dangerous if misused.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -47,9 +43,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-14T21:10:29Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-gv2c-5g79-h73c",
  "modified": "2023-11-08T00:00:20Z",
  "published": "2023-11-03T19:51:54Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Ibexa ezplatform-kernel download route allows filename change",
  "details": "### Impact\nThe route used for file downloads allows specifying the name of the downloaded file. This is an unintended side effect of the implementation, and means one could construct download URLs with filenames that have no relation to the actual file, which could lead to misunderstandings and confusion, and possibly other harm. As such it is a low severity vulnerability. It affects all supported versions of Ibexa DXP and eZ Platform, in installations where downloadable files exist.\n\n### Patches\nThe issue is fixed in all supported versions of ezsystems/ezplatform-kernel, see \"Patched versions\".\nAn advisory is also published for ezsystems/ezpublish-kernel and ibexa/core, please see those repositories.\nCommit: https://github.com/ezsystems/ezplatform-kernel/commit/affa2520e5e986e477ca7f7c93b9ca2c30188063\n\n### Workarounds\nNone, other than blocking all downloads.\n\n### References\nhttps://developers.ibexa.co/security-advisories/ibexa-sa-2023-005-vulnerabilities-in-solr-search-and-file-downloads",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -51,9 +47,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-03T19:51:54Z",
@@ -7,12 +7,8 @@
    "CVE-2003-0824"
  ],
  "details": "Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -56,9 +52,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -7,12 +7,8 @@
    "CVE-2003-0753"
  ],
  "details": "nphpd.php in newsPHP 216 and earlier allows remote attackers to read arbitrary files via a full pathname to the target file in the nphp_config[LangFile] parameter.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -24,9 +20,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -7,12 +7,8 @@
    "CVE-2003-0905"
  ],
  "details": "Unknown vulnerability in Windows Media Station Service and Windows Media Monitor Service components of Windows Media Services 4.1 allows remote attackers to cause a denial of service (disallowing new connections) via a certain sequence of TCP/IP packets.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -40,9 +36,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
--- a/Show More
+++ b/Show More