netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-08-21 18:32:50 +00:00
parent aa03f93c8c
commit 0be5b86878
108 changed files with 2176 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/08/GHSA-6v96-m24v-f58j/GHSA-6v96-m24v-f58j.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6v96-m24v-f58j",
"modified": "2024-08-21T18:31:00Z",
"published": "2024-08-21T18:31:00Z",
"aliases": [
"CVE-2024-43411"
],
"summary": "CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover",
"details": "### Affected Packages\n\nThe issue impacts only editor instances with enabled [version notifications](https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_config.html#cfg-versionCheck).\n\nPlease note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please [contact us](mailto:security@cksource.com).\n\n### Impact\n\nA theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. Although the vulnerability is purely hypothetical, we have addressed it in CKEditor 4.25.0-lts to ensure compliance with security best practices.\n\n### Patches\n\nThe issue has been recognized and patched. The fix is available in version 4.25.0-lts.\n\n### For More Information\n\nIf you have any questions or comments about this advisory, please email us at [security@cksource.com](mailto:security@cksource.com).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "ckeditor4"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.22.0"
},
{
"fixed": "4.25.0"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6v96-m24v-f58j"
},
{
"type": "WEB",
"url": "https://github.com/ckeditor/ckeditor4/commit/b5069c9cb769ea22eae1cbd7200f22b1cf2e3a7f"
},
{
"type": "PACKAGE",
"url": "https://github.com/ckeditor/ckeditor4"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2024-08-21T18:31:00Z",
"nvd_published_at": null
}
}
advisories/unreviewed/2022/05/GHSA-f824-fhqw-5fwj/GHSA-f824-fhqw-5fwj.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f824-fhqw-5fwj",
"modified": "2023-01-31T21:30:21Z",
"modified": "2024-08-21T18:31:25Z",
"published": "2022-05-24T22:00:29Z",
"aliases": [
"CVE-2019-16220"
advisories/unreviewed/2023/07/GHSA-8gf9-j4gp-qqf3/GHSA-8gf9-j4gp-qqf3.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8gf9-j4gp-qqf3",
"modified": "2023-12-12T15:30:58Z",
"modified": "2024-08-21T18:31:25Z",
"published": "2023-07-10T18:30:49Z",
"aliases": [
"CVE-2023-32250"
advisories/unreviewed/2023/07/GHSA-p3v2-rv86-5c5f/GHSA-p3v2-rv86-5c5f.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p3v2-rv86-5c5f",
"modified": "2023-12-12T15:30:58Z",
"modified": "2024-08-21T18:31:25Z",
"published": "2023-07-10T18:30:49Z",
"aliases": [
"CVE-2023-32254"
advisories/unreviewed/2023/10/GHSA-gxg7-pxwf-9r28/GHSA-gxg7-pxwf-9r28.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gxg7-pxwf-9r28",
"modified": "2024-01-25T09:30:20Z",
"modified": "2024-08-21T18:31:25Z",
"published": "2023-10-04T21:30:22Z",
"aliases": [
"CVE-2023-39191"
advisories/unreviewed/2023/11/GHSA-53pc-8xr3-68wx/GHSA-53pc-8xr3-68wx.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-53pc-8xr3-68wx",
"modified": "2023-11-03T09:32:49Z",
"modified": "2024-08-21T18:31:25Z",
"published": "2023-11-03T09:32:49Z",
"aliases": [
"CVE-2023-1194"
advisories/unreviewed/2024/02/GHSA-8mv9-w6jc-hxmg/GHSA-8mv9-w6jc-hxmg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8mv9-w6jc-hxmg",
"modified": "2024-02-29T03:33:18Z",
"modified": "2024-08-21T18:31:25Z",
"published": "2024-02-29T03:33:18Z",
"aliases": [
"CVE-2024-25833"
],
"details": "F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitrary SQL queries in database.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T01:44:16Z"
advisories/unreviewed/2024/03/GHSA-fhx8-5c23-x7x5/GHSA-fhx8-5c23-x7x5.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fhx8-5c23-x7x5",
"modified": "2024-03-01T15:31:37Z",
"modified": "2024-08-21T18:31:25Z",
"published": "2024-03-01T15:31:37Z",
"aliases": [
"CVE-2023-46950"
],
"details": "Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-01T14:15:53Z"
advisories/unreviewed/2024/03/GHSA-h9c5-fmrg-fj53/GHSA-h9c5-fmrg-fj53.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h9c5-fmrg-fj53",
"modified": "2024-03-12T18:31:14Z",
"modified": "2024-08-21T18:31:25Z",
"published": "2024-03-12T18:31:14Z",
"aliases": [
"CVE-2024-28340"
],
"details": "An information leak in the currentsetting.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sensitive information without any authentication required.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-12T17:15:59Z"
advisories/unreviewed/2024/03/GHSA-jqmg-p26g-933q/GHSA-jqmg-p26g-933q.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jqmg-p26g-933q",
"modified": "2024-03-12T21:30:59Z",
"modified": "2024-08-21T18:31:25Z",
"published": "2024-03-12T21:30:59Z",
"aliases": [
"CVE-2023-42308"
],
"details": "Cross Site Scripting (XSS) vulnerability in Manage Fastrack Subjects in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via the \"Subject Name\" and \"Subject Code\" Section.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-12T21:15:55Z"
advisories/unreviewed/2024/03/GHSA-m3mq-63hw-6hgx/GHSA-m3mq-63hw-6hgx.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m3mq-63hw-6hgx",
"modified": "2024-03-03T09:30:38Z",
"modified": "2024-08-21T18:31:25Z",
"published": "2024-03-03T09:30:38Z",
"aliases": [
"CVE-2024-25842"
],
"details": "An issue was discovered in Presta World \"Account Manager - Sales Representative & Dealers - CRM\" (prestasalesmanager) module for PrestaShop before version 9.0, allows remote attackers to escalate privilege and obtain sensitive information via the uploadLogo() and postProcess methods.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-03T09:15:06Z"
advisories/unreviewed/2024/04/GHSA-88cm-g4xq-fh44/GHSA-88cm-g4xq-fh44.json
+1 -1
View File
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/04/GHSA-9fgf-m63q-p2m6/GHSA-9fgf-m63q-p2m6.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9fgf-m63q-p2m6",
"modified": "2024-04-03T15:30:41Z",
"modified": "2024-08-21T18:31:25Z",
"published": "2024-04-03T15:30:41Z",
"aliases": [
"CVE-2024-30568"
],
"details": "Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the c4-IPAddr parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-03T13:16:02Z"
advisories/unreviewed/2024/04/GHSA-rr9m-5jgg-qrvf/GHSA-rr9m-5jgg-qrvf.json
+1 -1
View File
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2024/04/GHSA-w8pp-x465-w792/GHSA-w8pp-x465-w792.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w8pp-x465-w792",
"modified": "2024-04-15T21:30:46Z",
"modified": "2024-08-21T18:31:25Z",
"published": "2024-04-15T21:30:46Z",
"aliases": [
"CVE-2024-28557"
],
"details": "SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via crafted payload to update-admin.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-15T19:15:09Z"
advisories/unreviewed/2024/06/GHSA-4j99-4w4w-9ff3/GHSA-4j99-4w4w-9ff3.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4j99-4w4w-9ff3",
"modified": "2024-06-17T21:31:10Z",
"modified": "2024-08-21T18:31:26Z",
"published": "2024-06-17T21:31:10Z",
"aliases": [
"CVE-2024-37828"
],
"details": "A stored cross-site scripting (XSS) in Vermeg Agile Reporter v23.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field under the Set Broadcast Message module.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-17T21:15:51Z"
advisories/unreviewed/2024/06/GHSA-5vhq-c669-fmgr/GHSA-5vhq-c669-fmgr.json
+1
View File
@@ -28,6 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-1288",
"CWE-787"
],
"severity": "MODERATE",
advisories/unreviewed/2024/06/GHSA-68j3-86cc-wp27/GHSA-68j3-86cc-wp27.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-68j3-86cc-wp27",
"modified": "2024-06-12T15:31:45Z",
"modified": "2024-08-21T18:31:26Z",
"published": "2024-06-12T15:31:45Z",
"aliases": [
"CVE-2024-36691"
],
"details": "Insecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows authenticated attackers to arbitrarily modify users' account information.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-277"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-12T15:15:52Z"
advisories/unreviewed/2024/06/GHSA-6qp2-4fq6-h4pv/GHSA-6qp2-4fq6-h4pv.json
+1
View File
@@ -28,6 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-1288",
"CWE-787"
],
"severity": "MODERATE",
advisories/unreviewed/2024/06/GHSA-c56c-hf5f-5xjh/GHSA-c56c-hf5f-5xjh.json
+1 -1
View File
@@ -40,7 +40,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"severity": "CRITICAL",
"github_reviewed": false,

Some files were not shown because too many files have changed in this diff Show More