netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-cgfm-xwp7-2cvr
GHSA-g2c3-vwff-m3xr
GHSA-8mmm-9v2q-x3f9
GHSA-g2c3-vwff-m3xr
This commit is contained in:
advisory-database[bot]
2024-04-22 23:17:45 +00:00
parent 04ac7cae69
commit 0d4d326bf0
4 changed files with 121 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/08/GHSA-cgfm-xwp7-2cvr/GHSA-cgfm-xwp7-2cvr.json → advisories/github-reviewed/2022/08/GHSA-cgfm-xwp7-2cvr/GHSA-cgfm-xwp7-2cvr.json
+24 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cgfm-xwp7-2cvr",
"modified": "2022-09-02T00:01:03Z",
"modified": "2024-04-22T23:16:47Z",
"published": "2022-08-31T00:00:24Z",
"aliases": [
"CVE-2022-25887"
],
"summary": "Sanitize-html Vulnerable To REDoS Attacks",
"details": "The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "sanitize-html"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.1"
}
]
}
]
}
],
"references": [
{
@@ -40,11 +59,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T23:16:47Z",
"nvd_published_at": "2022-08-30T05:15:00Z"
}
}
advisories/github-reviewed/2022/08/GHSA-g2c3-vwff-m3xr/GHSA-g2c3-vwff-m3xr.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g2c3-vwff-m3xr",
"modified": "2024-04-22T23:17:12Z",
"published": "2022-08-29T20:06:54Z",
"aliases": [
"CVE-2022-21165"
],
"summary": "Font-Converter Vulnerable to Arbitrary Command Injection",
"details": "### Overview\nfont-converter is a FontForge wrapper that allows conversion between different font formats (TTF, WOFF, OTF)\n\nAll versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the `child_process.exec()` function.\n\n### PoC\n```js\nvar PUT = require('font-converter');\nvar x = \"$(touch success);# \";\ntry {\n new PUT(x, x, x, x);\n} catch (e) {\n console.log(e);\n}\n```",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "font-converter"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21165"
},
{
"type": "PACKAGE",
"url": "https://github.com/zgec/node-js-font-converter"
},
{
"type": "WEB",
"url": "https://github.com/zgec/node-js-font-converter/blob/master/index.js#L12"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-FONTCONVERTER-2976194"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T23:17:12Z",
"nvd_published_at": "2022-08-29T05:15:00Z"
}
}
advisories/unreviewed/2022/10/GHSA-8mmm-9v2q-x3f9/GHSA-8mmm-9v2q-x3f9.json → advisories/github-reviewed/2022/10/GHSA-8mmm-9v2q-x3f9/GHSA-8mmm-9v2q-x3f9.json
+32 -5
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8mmm-9v2q-x3f9",
"modified": "2022-10-14T19:00:39Z",
"modified": "2024-04-22T23:15:25Z",
"published": "2022-10-12T12:00:18Z",
"aliases": [
"CVE-2022-37611"
],
"details": "Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js.",
"summary": "tschaub gh-pages vulnerable to prototype pollution",
"details": "Prototype pollution vulnerability in tschaub gh-pages via the partial variable in util.js.",
"severity": [
{
"type": "CVSS_V3",
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "gh-pages"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.0"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +44,14 @@
"type": "WEB",
"url": "https://github.com/tschaub/gh-pages/issues/446"
},
{
"type": "WEB",
"url": "https://github.com/tschaub/gh-pages/pull/452"
},
{
"type": "PACKAGE",
"url": "https://github.com/tschaub/gh-pages"
},
{
"type": "WEB",
"url": "https://github.com/tschaub/gh-pages/blob/e363b144defe8e555f5a54251a6f7f1297c0e3f6/lib/util.js#L11"
@@ -39,8 +66,8 @@
"CWE-1321"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T23:15:25Z",
"nvd_published_at": "2022-10-12T01:15:00Z"
}
}
advisories/unreviewed/2022/08/GHSA-g2c3-vwff-m3xr/GHSA-g2c3-vwff-m3xr.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g2c3-vwff-m3xr",
"modified": "2022-09-03T00:00:18Z",
"published": "2022-08-29T20:06:54Z",
"aliases": [
"CVE-2022-21165"
],
"details": "All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child_process.exec() function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21165"
},
{
"type": "WEB",
"url": "https://github.com/zgec/node-js-font-converter/blob/master/index.js%23L12"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-FONTCONVERTER-2976194"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-29T05:15:00Z"
}
}