netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-9gq6-6936-885w
GHSA-c85f-pcx6-2ghm
GHSA-crmg-rp64-5cm3
GHSA-v6g6-3cm3-vf6c
GHSA-wcjw-3v6p-4v3r
GHSA-wf9g-c67g-h4ch
This commit is contained in:
advisory-database[bot]
2024-09-12 17:04:59 +00:00
parent 83f2892039
commit 09b9add322
6 changed files with 210 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/09/GHSA-9gq6-6936-885w/GHSA-9gq6-6936-885w.json → advisories/github-reviewed/2024/09/GHSA-9gq6-6936-885w/GHSA-9gq6-6936-885w.json
+35 -4
View File
@@ -1,26 +1,57 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9gq6-6936-885w",
"modified": "2024-09-12T15:33:00Z",
"modified": "2024-09-12T17:03:57Z",
"published": "2024-09-12T15:33:00Z",
"aliases": [
"CVE-2024-45848"
],
"summary": "MindsDB Eval Injection vulnerability",
"details": "An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specially crafted ‘INSERT’ query containing Python code is run against a database created with the ChromaDB engine, the code will be passed to an eval function and executed on the server.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mindsdb"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "23.12.4.0"
},
{
"fixed": "24.7.4.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45848"
},
{
"type": "WEB",
"url": "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80"
},
{
"type": "PACKAGE",
"url": "https://github.com/mindsdb/mindsdb"
},
{
"type": "WEB",
"url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb"
@@ -31,8 +62,8 @@
"CWE-95"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-09-12T17:03:57Z",
"nvd_published_at": "2024-09-12T13:15:13Z"
}
}
advisories/unreviewed/2024/09/GHSA-c85f-pcx6-2ghm/GHSA-c85f-pcx6-2ghm.json → advisories/github-reviewed/2024/09/GHSA-c85f-pcx6-2ghm/GHSA-c85f-pcx6-2ghm.json
+35 -4
View File
@@ -1,26 +1,57 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c85f-pcx6-2ghm",
"modified": "2024-09-12T15:33:00Z",
"modified": "2024-09-12T17:03:55Z",
"published": "2024-09-12T15:33:00Z",
"aliases": [
"CVE-2024-45849"
],
"summary": "MindsDB Eval Injection vulnerability",
"details": "An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for list creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mindsdb"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "23.10.5.0"
},
{
"fixed": "24.7.4.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45849"
},
{
"type": "WEB",
"url": "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80"
},
{
"type": "PACKAGE",
"url": "https://github.com/mindsdb/mindsdb"
},
{
"type": "WEB",
"url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb"
@@ -31,8 +62,8 @@
"CWE-95"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-09-12T17:03:55Z",
"nvd_published_at": "2024-09-12T13:15:13Z"
}
}
advisories/unreviewed/2024/09/GHSA-crmg-rp64-5cm3/GHSA-crmg-rp64-5cm3.json → advisories/github-reviewed/2024/09/GHSA-crmg-rp64-5cm3/GHSA-crmg-rp64-5cm3.json
+35 -4
View File
@@ -1,26 +1,57 @@
{
"schema_version": "1.4.0",
"id": "GHSA-crmg-rp64-5cm3",
"modified": "2024-09-12T15:33:00Z",
"modified": "2024-09-12T17:03:59Z",
"published": "2024-09-12T15:33:00Z",
"aliases": [
"CVE-2024-45847"
],
"summary": "MindsDB Eval Injection vulnerability",
"details": "An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration engine, the code will be passed to an eval function and executed on the server.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mindsdb"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "23.11.4.2"
},
{
"fixed": "24.7.4.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45847"
},
{
"type": "WEB",
"url": "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80"
},
{
"type": "PACKAGE",
"url": "https://github.com/mindsdb/mindsdb"
},
{
"type": "WEB",
"url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb"
@@ -31,8 +62,8 @@
"CWE-95"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-09-12T17:03:59Z",
"nvd_published_at": "2024-09-12T13:15:13Z"
}
}
advisories/unreviewed/2024/09/GHSA-v6g6-3cm3-vf6c/GHSA-v6g6-3cm3-vf6c.json → advisories/github-reviewed/2024/09/GHSA-v6g6-3cm3-vf6c/GHSA-v6g6-3cm3-vf6c.json
+35 -4
View File
@@ -1,26 +1,57 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v6g6-3cm3-vf6c",
"modified": "2024-09-12T15:33:00Z",
"modified": "2024-09-12T17:03:53Z",
"published": "2024-09-12T15:33:00Z",
"aliases": [
"CVE-2024-45850"
],
"summary": "MindsDB Eval Injection vulnerability",
"details": "An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for site column creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mindsdb"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "23.10.5.0"
},
{
"fixed": "24.7.4.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45850"
},
{
"type": "WEB",
"url": "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80"
},
{
"type": "PACKAGE",
"url": "https://github.com/mindsdb/mindsdb"
},
{
"type": "WEB",
"url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb"
@@ -31,8 +62,8 @@
"CWE-95"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-09-12T17:03:53Z",
"nvd_published_at": "2024-09-12T13:15:13Z"
}
}
advisories/unreviewed/2024/09/GHSA-wcjw-3v6p-4v3r/GHSA-wcjw-3v6p-4v3r.json → advisories/github-reviewed/2024/09/GHSA-wcjw-3v6p-4v3r/GHSA-wcjw-3v6p-4v3r.json
+35 -4
View File
@@ -1,26 +1,57 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wcjw-3v6p-4v3r",
"modified": "2024-09-12T15:33:00Z",
"modified": "2024-09-12T17:04:01Z",
"published": "2024-09-12T15:33:00Z",
"aliases": [
"CVE-2024-45846"
],
"summary": "MindsDB Eval Injection vulnerability",
"details": "An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine, the code will be passed to an eval function and executed on the server.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mindsdb"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "23.10.3.0"
},
{
"fixed": "24.7.4.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45846"
},
{
"type": "WEB",
"url": "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80"
},
{
"type": "PACKAGE",
"url": "https://github.com/mindsdb/mindsdb"
},
{
"type": "WEB",
"url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb"
@@ -31,8 +62,8 @@
"CWE-95"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-09-12T17:04:00Z",
"nvd_published_at": "2024-09-12T13:15:12Z"
}
}
advisories/unreviewed/2024/09/GHSA-wf9g-c67g-h4ch/GHSA-wf9g-c67g-h4ch.json → advisories/github-reviewed/2024/09/GHSA-wf9g-c67g-h4ch/GHSA-wf9g-c67g-h4ch.json
+35 -4
View File
@@ -1,26 +1,57 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wf9g-c67g-h4ch",
"modified": "2024-09-12T15:33:01Z",
"modified": "2024-09-12T17:03:51Z",
"published": "2024-09-12T15:33:01Z",
"aliases": [
"CVE-2024-45851"
],
"summary": "MindsDB Eval Injection vulnerability",
"details": "An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for list item creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mindsdb"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "23.10.5.0"
},
{
"fixed": "24.7.4.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45851"
},
{
"type": "WEB",
"url": "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80"
},
{
"type": "PACKAGE",
"url": "https://github.com/mindsdb/mindsdb"
},
{
"type": "WEB",
"url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb"
@@ -31,8 +62,8 @@
"CWE-95"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-09-12T17:03:51Z",
"nvd_published_at": "2024-09-12T13:15:14Z"
}
}