mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-4h9j-f98m-p4hg GHSA-2xm2-23ff-p8ww GHSA-p9hh-mh5x-wvx3 GHSA-4h9j-f98m-p4hg
This commit is contained in:
advisory-database[bot]
@@ -0,0 +1,69 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4h9j-f98m-p4hg",
|
||||
"modified": "2025-04-11T19:59:37Z",
|
||||
"published": "2022-05-02T06:19:32Z",
|
||||
"aliases": [
|
||||
"CVE-2010-1153"
|
||||
],
|
||||
"summary": "TYPO3 PHP remote file inclusion vulnerability",
|
||||
"details": "PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP code via a URL in an input field associated with the className variable.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "typo3/cms"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.3.0"
|
||||
},
|
||||
{
|
||||
"fixed": "4.3.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1153"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/TYPO3/typo3"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://web.archive.org/web/20100813082506/http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-008"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://marc.info/?l=oss-security&m=127092306209177&w=2"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2010/04/12/1"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-94"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-04-11T19:59:37Z",
|
||||
"nvd_published_at": "2010-04-20T19:30:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,64 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2xm2-23ff-p8ww",
|
||||
"modified": "2025-04-11T19:59:04Z",
|
||||
"published": "2025-04-11T19:59:04Z",
|
||||
"aliases": [
|
||||
"CVE-2025-32426"
|
||||
],
|
||||
"summary": "Formie has XSS vulnerability for email notification content for preview",
|
||||
"details": "### Impact\nIt is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means (a delivered email).\n\nThis would require access to the form's email notification settings.\n\n### Patches\nThis has been fixed in Formie 2.1.44. Users should ensure they are running at least this version.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "verbb/formie"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "2.1.44"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"last_known_affected_version_range": "<= 2.1.43"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/verbb/formie/security/advisories/GHSA-2xm2-23ff-p8ww"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32426"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/verbb/formie"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-04-11T19:59:04Z",
|
||||
"nvd_published_at": "2025-04-11T14:15:25Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,64 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-p9hh-mh5x-wvx3",
|
||||
"modified": "2025-04-11T19:58:38Z",
|
||||
"published": "2025-04-11T19:58:38Z",
|
||||
"aliases": [
|
||||
"CVE-2025-32427"
|
||||
],
|
||||
"summary": "Formie has XSS vulnerability for importing forms",
|
||||
"details": "### Impact\nWhen importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported.\n\nAs imports are undertaking primarily by users who have themselves exported the form from one environment to another, and would require direct manipulation of the JSON export, this is marked as moderate. This vulnerability will not occur unless someone deliberately tampers with the export.\n\n### Patches\nThis has been fixed in Formie 2.1.44. Users should ensure they are running at least this version.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "verbb/formie"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "2.1.44"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"last_known_affected_version_range": "<= 2.1.43"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/verbb/formie/security/advisories/GHSA-p9hh-mh5x-wvx3"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32427"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/verbb/formie"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-04-11T19:58:38Z",
|
||||
"nvd_published_at": "2025-04-11T14:15:25Z"
|
||||
}
|
||||
}
|
||||
@@ -1,39 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4h9j-f98m-p4hg",
|
||||
"modified": "2025-04-11T03:34:07Z",
|
||||
"published": "2022-05-02T06:19:32Z",
|
||||
"aliases": [
|
||||
"CVE-2010-1153"
|
||||
],
|
||||
"details": "PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP code via a URL in an input field associated with the className variable.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1153"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://marc.info/?l=oss-security&m=127092306209177&w=2"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-008"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2010/04/12/1"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-94"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2010-04-20T19:30:00Z"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user