netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-38v3-r7mm-56j2
GHSA-3r6p-fq38-2gpr
GHSA-96rx-8rv9-v6vx
GHSA-9gvv-47x2-579h
GHSA-gm77-v33h-cghm
GHSA-m444-vxcc-2cwp
GHSA-whww-hhj9-9f35
This commit is contained in:
advisory-database[bot]
2024-07-26 00:33:42 +00:00
parent dd2ab8e89d
commit 0e3918c95b
7 changed files with 260 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/07/GHSA-38v3-r7mm-56j2/GHSA-38v3-r7mm-56j2.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-38v3-r7mm-56j2",
"modified": "2024-07-26T00:32:09Z",
"published": "2024-07-26T00:32:09Z",
"aliases": [
"CVE-2024-24622"
],
"details": "Softaculous Webuzo contains a command injection in the password reset functionality. A remote, authenticated attacker can exploit this vulnerability to gain code execution on the system.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24622"
},
{
"type": "WEB",
"url": "https://blog.exodusintel.com/2024/07/24/softaculous-webuzo-password-reset-command-injection"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-25T22:15:05Z"
}
}
advisories/unreviewed/2024/07/GHSA-3r6p-fq38-2gpr/GHSA-3r6p-fq38-2gpr.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3r6p-fq38-2gpr",
"modified": "2024-07-26T00:32:09Z",
"published": "2024-07-26T00:32:09Z",
"aliases": [
"CVE-2024-24621"
],
"details": "Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulnerability to gain full server access as the root user.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24621"
},
{
"type": "WEB",
"url": "https://blog.exodusintel.com/2024/07/25/softaculous-webuzo-authentication-bypass"
}
],
"database_specific": {
"cwe_ids": [
"CWE-697"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-25T22:15:05Z"
}
}
advisories/unreviewed/2024/07/GHSA-96rx-8rv9-v6vx/GHSA-96rx-8rv9-v6vx.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-96rx-8rv9-v6vx",
"modified": "2024-07-26T00:32:10Z",
"published": "2024-07-26T00:32:10Z",
"aliases": [
"CVE-2024-24623"
],
"details": "Softaculous Webuzo contains a command injection vulnerability in the FTP management functionality. A remote, authenticated attacker can exploit this vulnerability to gain code execution on the system.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24623"
},
{
"type": "WEB",
"url": "https://blog.exodusintel.com/2024/07/25/softaculous-webuzo-ftp-management-command-injection"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-25T22:15:05Z"
}
}
advisories/unreviewed/2024/07/GHSA-9gvv-47x2-579h/GHSA-9gvv-47x2-579h.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9gvv-47x2-579h",
"modified": "2024-07-26T00:32:10Z",
"published": "2024-07-26T00:32:10Z",
"aliases": [
"CVE-2024-41468"
],
"details": "Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the cmdinput parameter at /goform/exeCommand",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41468"
},
{
"type": "WEB",
"url": "https://github.com/iotresearch/iot-vuln/blob/main/Tenda/FH1201/exeCommand/README.md"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-25T22:15:09Z"
}
}
advisories/unreviewed/2024/07/GHSA-gm77-v33h-cghm/GHSA-gm77-v33h-cghm.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gm77-v33h-cghm",
"modified": "2024-07-26T00:32:10Z",
"published": "2024-07-26T00:32:10Z",
"aliases": [
"CVE-2024-41473"
],
"details": "Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41473"
},
{
"type": "WEB",
"url": "https://github.com/iotresearch/iot-vuln/tree/main/Tenda/FH1201/WriteFacMac"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-25T22:15:09Z"
}
}
advisories/unreviewed/2024/07/GHSA-m444-vxcc-2cwp/GHSA-m444-vxcc-2cwp.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m444-vxcc-2cwp",
"modified": "2024-07-26T00:32:10Z",
"published": "2024-07-26T00:32:10Z",
"aliases": [
"CVE-2024-38103"
],
"details": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38103"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38103"
}
],
"database_specific": {
"cwe_ids": [
"CWE-359"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-25T22:15:08Z"
}
}
advisories/unreviewed/2024/07/GHSA-whww-hhj9-9f35/GHSA-whww-hhj9-9f35.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-whww-hhj9-9f35",
"modified": "2024-07-26T00:32:10Z",
"published": "2024-07-26T00:32:10Z",
"aliases": [
"CVE-2024-3938"
],
"details": "The \"reset password\" login page accepted an HTML injection via URL parameters.\n\nThis has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a http://localhost:8082/dotAdmin/#/public/login?resetEmailSent=true&resetEmail=%3Ch1%3E%3Ca%20href%3D%22https:%2F%2Fgoogle.com%22%3ECLICK%20ME%3C%2Fa%3E%3C%2Fh1%3E \n\nThis will result in a view along these lines:\n\n\n\n\n\n * OWASP Top 10 - A03: Injection\n * CVSS Score: 5.4\n * AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator \n * https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N&... https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3938"
},
{
"type": "WEB",
"url": "https://auth.dotcms.com/security/SI-71"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-25T22:15:08Z"
}
}