netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-4crf-28c7-v4gr
GHSA-6247-7862-q2pq
GHSA-8m84-h9hh-3cfh
GHSA-w7cp-g8v7-r54m
GHSA-6247-7862-q2pq
This commit is contained in:
advisory-database[bot]
2024-08-21 20:11:09 +00:00
parent 7f1007fd82
commit 07e5130401
5 changed files with 170 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/08/GHSA-4crf-28c7-v4gr/GHSA-4crf-28c7-v4gr.json → advisories/github-reviewed/2024/08/GHSA-4crf-28c7-v4gr/GHSA-4crf-28c7-v4gr.json
+31 -4
View File
@@ -1,20 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4crf-28c7-v4gr",
"modified": "2024-08-21T06:32:18Z",
"modified": "2024-08-21T20:09:39Z",
"published": "2024-08-21T06:32:18Z",
"aliases": [
"CVE-2024-6508"
],
"summary": "Openshift Console insufficient entropy vulnerability",
"details": "An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/openshift/console"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.0.6"
}
]
}
]
}
],
"references": [
{
@@ -28,6 +51,10 @@
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295777"
},
{
"type": "PACKAGE",
"url": "https://github.com/openshift/console"
}
],
"database_specific": {
@@ -35,8 +62,8 @@
"CWE-331"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-08-21T20:09:39Z",
"nvd_published_at": "2024-08-21T06:15:08Z"
}
}
advisories/github-reviewed/2024/08/GHSA-6247-7862-q2pq/GHSA-6247-7862-q2pq.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6247-7862-q2pq",
"modified": "2024-08-21T20:10:17Z",
"published": "2024-08-21T00:30:29Z",
"aliases": [
"CVE-2024-22281"
],
"summary": "Apache Helix Front (UI) component contained a hard-coded secret",
"details": "The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies.\n\nThis issue affects Apache Helix Front (UI): all versions.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.helix:helix"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.4.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22281"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/helix"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/zt26fpmrqx3fzcy8nv3b43kb3xllo5ny"
}
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-08-21T20:10:17Z",
"nvd_published_at": "2024-08-20T23:15:03Z"
}
}
advisories/unreviewed/2024/08/GHSA-8m84-h9hh-3cfh/GHSA-8m84-h9hh-3cfh.json → advisories/github-reviewed/2024/08/GHSA-8m84-h9hh-3cfh/GHSA-8m84-h9hh-3cfh.json
+34 -4
View File
@@ -1,26 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8m84-h9hh-3cfh",
"modified": "2024-08-21T15:30:53Z",
"modified": "2024-08-21T20:10:12Z",
"published": "2024-08-21T12:30:25Z",
"aliases": [
"CVE-2023-49198"
],
"summary": "Apache SeaTunnel SQL Injection vulnerability",
"details": "Mysql security vulnerability in Apache SeaTunnel.\n\nAttackers can read files on the MySQL server by modifying the information in the MySQL URL\n\n allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPacket=655360\nThis issue affects Apache SeaTunnel: 1.0.0.\n\nUsers are recommended to upgrade to version [1.0.1], which fixes the issue.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.seatunnel:seatunnel"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.0.1"
}
]
}
],
"versions": [
"1.0.0"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49198"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/seatunnel"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/48j9f1nsn037mgzc4j9o51nwglb1s08h"
@@ -31,8 +61,8 @@
"CWE-552"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-08-21T20:10:12Z",
"nvd_published_at": "2024-08-21T10:15:04Z"
}
}
advisories/unreviewed/2024/08/GHSA-w7cp-g8v7-r54m/GHSA-w7cp-g8v7-r54m.json → advisories/github-reviewed/2024/08/GHSA-w7cp-g8v7-r54m/GHSA-w7cp-g8v7-r54m.json
+40 -6
View File
@@ -1,17 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w7cp-g8v7-r54m",
"modified": "2024-08-21T18:31:27Z",
"modified": "2024-08-21T20:10:02Z",
"published": "2024-08-21T18:31:27Z",
"aliases": [
"CVE-2024-41937"
],
"summary": "Apache Airflow Cross-site Scripting Vulnerability",
"details": "Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link.\nUsers should upgrade to 2.10.0 or later, which fixes this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.0"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +48,14 @@
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/40933"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/f1852c2ab28b155e196569780013fbb61a4a1f98"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/lwlmgg6hqfmkpvw5py4w53hxyl37jl6d"
@@ -31,9 +65,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-08-21T20:10:02Z",
"nvd_published_at": "2024-08-21T16:15:08Z"
}
}
advisories/unreviewed/2024/08/GHSA-6247-7862-q2pq/GHSA-6247-7862-q2pq.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6247-7862-q2pq",
"modified": "2024-08-21T00:30:29Z",
"published": "2024-08-21T00:30:29Z",
"aliases": [
"CVE-2024-22281"
],
"details": "** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies.\n\nThis issue affects Apache Helix Front (UI): all versions.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22281"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/zt26fpmrqx3fzcy8nv3b43kb3xllo5ny"
}
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-20T23:15:03Z"
}
}