Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-02 05:14:13 +00:00
parent 9e5e489126
commit 128b507569
819 changed files with 1662 additions and 4986 deletions
@@ -3,9 +3,7 @@
  "id": "GHSA-35fr-h7jr-hh86",
  "modified": "2021-04-27T18:03:07Z",
  "published": "2019-12-06T18:55:47Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria",
  "details": "Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response.\n\n### Impact\n\n1. Cross-User Defacement\n2. Cache Poisoning\n3. Cross-Site Scripting (XSS)\n4. Page Hijacking\n\n\n### Root Cause\n\nThe root cause is due to the usage of Netty without the HTTP header validation.\n\nhttps://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/common/DefaultHttpHeaders.java#L23\n\n### Patches\n\nThis vulnerability has been patched in 0.97.0.\n\n### References\n\n[CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')](https://cwe.mitre.org/data/definitions/113.html)\nhttps://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [GitHub](https://github.com/line/armeria/issues)",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-22wc-c9wj-6q2v",
  "modified": "2021-04-16T23:11:53Z",
  "published": "2021-04-19T15:12:05Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "VVE-2021-0001: Memory corruption using function calls within arrays",
  "details": "### Impact\nWhen performing a function call inside an array, there is a memory corruption issue that occurs because of an incorrect pointer to the the tip of the stack.\n\n### Patches\nThis issue was partially fixed in [VVE-2020-0004](https://github.com/vyperlang/vyper/security/advisories/GHSA-2r3x-4mrv-mcxf), however the fix did not update similar code for arrays, which had a similar issue. The issue is fully fixed in https://github.com/vyperlang/vyper/pull/2345",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-2pwh-52h7-7j84",
  "modified": "2021-04-13T17:35:23Z",
  "published": "2021-04-16T19:52:49Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "JavaScript execution via malicious molfiles (XSS)",
  "details": "### Impact\nThe viewer plugin implementation of `<mol:molecule>` renders molfile data directly inside a `<script>` tag without any escaping. Arbitrary JavaScript code can thus be executed in the client browser via crafted molfiles.\n\n### Patches\nPatched in v0.3.0: Molfile data is now rendered as value of a hidden `<input>` tag and escaped via JSF's mechanisms.\n\n### Workarounds\nNo workaround available.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Authentication Bypass",
  "details": "When configured to use authentication (`-Dnacos.core.auth.enabled=true`) Nacos uses the `AuthFilter` servlet filter to enforce authentication. This filter has a [backdoor](https://github.com/alibaba/nacos/blob/5fa05aef52f7432aeab19fe53035431b9d8c91d9/core/src/main/java/com/alibaba/nacos/core/auth/AuthFilter.java#L78-L81) that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the `user-agent` HTTP header so it can be easily spoofed.\n\nThe following request to the `configuration` endpoint gets rejected as we are not providing any credentials:\n```\n❯ curl -X POST \"http://127.0.0.1:8848/nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld\"\n{\"timestamp\":\"2020-12-02T14:33:57.154+0000\",\"status\":403,\"error\":\"Forbidden\",\"message\":\"unknown user!\",\"path\":\"/nacos/v1/cs/configs\"}                                                                                                       \n```\n\nHowever the following one gets accepted by using the `Nacos-Server` user-agent header:\n```\n❯ curl -X POST -A Nacos-Server \"http://127.0.0.1:8848/nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld\"\ntrue \n```\n\n#### Impact\n\nThis issue may allow any user to carry out any administrative tasks on the Nacos server.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-375m-5fvv-xq23",
  "modified": "2021-04-16T23:17:39Z",
  "published": "2021-04-19T15:11:54Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "VVE-2021-0002: Incorrect `returndatasize` when using simple forwarder proxies deployed prior to EIP-1167 adoption",
  "details": "## Background\n\n@tjayrush reported a data handling issue with certain Web3 libraries using Vyper-deploy forwarder proxy contracts using our Vyper's built-in `create_forwarder_to` function prior to our change to support EIP-1167 style forwarder proxies.\n\n### Impact\nIf you are an end user of a forwarder-style proxy deployed using Vyper's built-in `create_forwarder_to` function AND you have a function that returns >4096 bytes AND you do no return data sanitation on the value returned, you could potentially see a data corruption issue.\n\nOtherwise, if you are handling the result of a return call AND you expect a specific `RETURNDATASIZE` that is less than 4096 (such as `SafeERC20.safeTransfer`) then the call will fail that check.\n\n### Patches\nThe issue was patched when we upgraded to EIP-1167 style forwarder proxies in #2281.\n\n### Workarounds\nIf you are making a call to a contract method that is expected to return <= 4096 bytes, there is no issue as the ABI decoders in both Solidity and Vyper will truncate the data properly. Web3 libraries will also do this, unless you are doing `eth_call` or `eth_sendTransaction` directly.\n\nIf you are using a Solidity library that checks `RETURNDATASIZE` of an external call to a forwarder proxy deployed prior to this patch, it will fail on that assertion (such as `SafeERC20.safeTransfer`). The workaround is to always do a greater than or equal to check, rather than a strict equals to check.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-3h5r-928v-mxhh",
  "modified": "2021-10-08T21:22:53Z",
  "published": "2021-04-19T14:49:13Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11",
  "details": "Missing check in UIDL request handler in `com.vaadin:flow-server` versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.\n\n- https://vaadin.com/security/cve-2018-25007",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-3pcr-4982-548m",
  "modified": "2021-04-12T22:33:05Z",
  "published": "2021-04-13T15:13:37Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Exposure of .env if project root is configured as web root in shopware/production",
  "details": "### Impact\n\nThe .env and other sensitive files can be leaked if the project root and not `/public` is configured as the web root.\n\n### Patches\nWe recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.\n\nhttps://www.shopware.com/en/download/#shopware-6\n\n### Workarounds\n\nYou should always use `/public` as the web root.\n\nFor older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.\n\nhttps://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659\n\n### For more information\nhttps://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-4mg9-vhxq-vm7j",
  "modified": "2021-11-18T19:46:31Z",
  "published": "2021-04-29T21:52:53Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database",
  "details": "### Impact\n\nThose using SQL Server with Laravel and allowing user input to be passed directly to the `limit` and `offset` functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.\n\n### Patches\n\nThis problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.\n\n### Workarounds\n\nYou may workaround this vulnerability by ensuring that only integers are passed to the `limit` and `offset` functions, as well as the `skip` and `take` functions.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-63rq-p8fp-524q",
  "modified": "2021-04-12T18:44:12Z",
  "published": "2021-04-13T15:12:06Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Potential API key leak",
  "details": "If a user is actively blackholing the location or weather APIs, or those APIs become otherwise unavailable, it is possible for the API keys to get leaked to the active IRC channel.\n\nThis is patched in v1.2.4",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-76f4-fw33-6j2v",
  "modified": "2021-10-08T21:23:41Z",
  "published": "2021-04-19T14:48:26Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Potential sensitive data exposure in applications using Vaadin 15",
  "details": "Insecure configuration of default `ObjectMapper` in `com.vaadin:flow-server` versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. `@RestController`\n\n- https://vaadin.com/security/cve-2020-36319",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-7fjp-g4m7-fx23",
  "modified": "2021-04-12T20:05:57Z",
  "published": "2021-04-13T15:12:26Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "User (Encrypted) Password Field Being Serialised",
  "details": "### Impact\nLeaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.\n\n### Patches\nIssue has been patched in version 0.3.7-beta and onwards.\n\n### Workarounds\nAdd the 'password' field to the Users model file in the hidden array:\n\n```php\n\n    /**\n     * The attributes that should be hidden for arrays.\n     *\n     * @var array\n     */\n    protected $hidden = [\n        'remember_token',\n        'password',\n    ];\n```\n\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [pwweb/laravel-core](https://github.com/pwweb/laravel-core)\n* Email us at [security@pw-websolutions.com](mailto:security@pw-websolutions.com)",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-82mf-mmh7-hxp5",
  "modified": "2021-10-08T21:23:58Z",
  "published": "2021-04-19T14:48:15Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Directory traversal in development mode handler in Vaadin 14 and 15-17",
  "details": "Improper URL validation in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.\n\n- https://vaadin.com/security/cve-2020-36321",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-88rc-3p98-rgvx",
  "modified": "2021-04-12T22:33:13Z",
  "published": "2021-04-13T15:13:48Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "After order payment process manipulation in shopware/platform and shopware/core ",
  "details": "### Impact\n\nAfter order payment process manipulation\n\n### Patches\nWe recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.\n\nhttps://www.shopware.com/en/download/#shopware-6\n\n### Workarounds\n\nFor older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.\n\nhttps://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659\n\n### For more information\nhttps://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-9h6g-6mxg-vvp4",
  "modified": "2021-10-08T21:24:35Z",
  "published": "2021-04-19T14:47:18Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Timing side channel vulnerability in endpoint request handler in Vaadin 15-19",
  "details": "Non-constant-time comparison of CSRF tokens in endpoint request handler in `com.vaadin:flow-server` versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.\n\n- https://vaadin.com/security/cve-2021-31406",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-c6c4-7x48-4cqp",
  "modified": "2021-10-08T21:24:15Z",
  "published": "2021-04-19T14:47:47Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18",
  "details": "Non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:flow-server` versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack.\n\n- https://vaadin.com/security/cve-2021-31404",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-crh4-294p-vcfq",
  "modified": "2021-10-08T21:22:01Z",
  "published": "2021-04-19T14:53:20Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17",
  "details": "Unsafe validation RegEx in `EmailField` component in `com.vaadin:vaadin-text-field-flow` versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.\n\n- https://vaadin.com/security/cve-2021-31405",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-j9wr-49vq-rm5g",
  "modified": "2021-10-08T21:24:54Z",
  "published": "2021-04-19T14:46:49Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19",
  "details": "Vulnerability in OSGi integration in `com.vaadin:flow-server` versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.\n\n- https://vaadin.com/security/cve-2021-31407",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-jgpv-4h4c-xhw3",
  "modified": "2021-04-22T17:01:01Z",
  "published": "2021-04-23T16:54:36Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Uncontrolled Resource Consumption in pillow",
  "details": "### Impact\n_Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large._\n\n### Patches\n_An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image._\n\n### Workarounds\n_An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image._\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-27921\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [example link to repo](http://example.com)\n* Email us at [example email address](mailto:example@example.com)",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-jqj4-r483-4gvr",
  "modified": "2021-10-08T21:23:23Z",
  "published": "2021-04-19T14:48:51Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13",
  "details": "Missing output sanitization in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL.\n\n- https://vaadin.com/security/cve-2019-25027",
  "severity": [
@@ -8,9 +8,7 @@
  ],
  "summary": "Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain",
  "details": "### Impact\nLack of input validation of the Zendesk subdomain could expose users of the library to Server Side Request Forgery (SSRF).\n\n### Resolution\nValidate the provided Zendesk subdomain to be a valid subdomain in:\n* getAuthUrl\n* getAccessToken",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
--- a/Show More
+++ b/Show More