Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-06 05:06:54 +00:00
parent d8cd3042f6
commit 101109a87a
887 changed files with 1495 additions and 4485 deletions
@@ -128,9 +128,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:38:03Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Apache Camel's XSLT component allows remote attackers to execute arbitrary Java methods",
  "details": "The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Apache Camel allows remote actor to read arbitrary files via external entity in invalid XML string or GenericFile object",
  "details": "Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -110,9 +108,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:46:27Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Improper Control of Generation of Code in Apache Camel",
  "details": "Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including \"$simple{}\" in a CamelFileName message header to a (1) FILE or (2) FTP producer.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -88,9 +88,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-23T23:35:55Z",
@@ -66,9 +66,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-21T16:59:51Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-c2hm-mjxv-89r4",
  "modified": "2024-09-16T16:50:14Z",
  "published": "2023-09-04T17:02:00Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Multiple soundness issues in lexical",
  "details": "`lexical` contains multiple soundness issues:\n\n 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)\n 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)\n 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)\n 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)\n1. [`radix()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/126)\n\nThe crate also has some correctness issues.\n\n## Alternatives\n\nFor quickly parsing floating-point numbers third-party crates are no longer needed. A fast float parsing algorithm by the author of `lexical` has been [merged](https://github.com/rust-lang/rust/pull/86761) into libcore.\n\nFor quickly parsing integers, consider `atoi` and `btoi` crates (100% safe code). `atoi_radix10` provides even faster parsing, but only with `-C target-cpu=native`, and at the cost of some `unsafe`.\n\nFor formatting integers in a `#[no_std]` context consider the [`numtoa`](https://crates.io/crates/numtoa) crate.\n\nFor working with big numbers consider `num-bigint` and `num-traits`.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -46,9 +42,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-04T17:02:00Z",
@@ -66,9 +66,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-21T16:59:57Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-rrjw-j4m2-mf34",
  "modified": "2024-09-04T17:18:37Z",
  "published": "2023-09-25T20:21:16Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "gix-transport code execution vulnerability",
  "details": "The `gix-transport` crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the `ssh` program, leading to arbitrary code execution.\n\nPoC: `gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'`\n\nThis will launch a calculator on OSX.\n\nSee https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in `git`.\n\nThanks for [vin01](https://github.com/vin01) for disclosing this issue.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-vx74-f528-fxqg",
  "modified": "2023-10-10T18:23:21Z",
  "published": "2023-10-10T18:23:21Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset",
  "details": "### Impact\n\nRapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound cause denial of service.\n\nSee https://www.cve.org/CVERecord?id=CVE-2023-44487 for details.\n\n### Patches\n\nnghttp2 v1.57.0 mitigates this vulnerability by default.\n\n### Workarounds\n\nIf upgrading to nghttp2 v1.57.0 is not possible, implement `nghttp2_on_frame_recv_callback`, and check and count RST_STREAM frames.  If excessive number of RST_STREAM are received, then take action, such as dropping connection silently, or call `nghttp2_submit_goaway` and gracefully terminate the connection.\n\n### References\n\nThe following commit mitigates this vulnerability:\n\n- https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832\n",
  "severity": [
@@ -89,9 +89,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-28T20:53:41Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-4h72-34j6-j8x7",
  "modified": "2023-12-18T19:31:12Z",
  "published": "2023-12-18T19:31:12Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Maloja error page XSS vulnerability",
  "details": "### Impact\nThe error page for a missing path echoes the path back to the user. If this contains HTML, an attacker could execute a script on the user's machine inside the Maloja context and perform authorized actions like scrobbling or deleting scrobbles.\nThis does not affect the security of your server. The exploit is purely client-side.\nSince there is very little incentive to mess with your scrobble data and it requires very specific targeting (an attacker would have to send a user a link to their own server),  the severity rating might be misleading.\n\n### Patches\nThe Vulnerability is patched in 3.2.2\n",
  "severity": [
@@ -50,9 +50,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-13T23:13:15Z",
@@ -58,9 +58,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-24T21:45:58Z",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
--- a/Show More
+++ b/Show More