netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-5ccf-884p-4jjq
GHSA-6gmf-2369-c76c
GHSA-747f-ww56-4q4h
GHSA-w6hh-w36c-vxmw
This commit is contained in:
advisory-database[bot]
2025-03-21 03:39:54 +00:00
parent 14071a28b0
commit 14b9cb0017
4 changed files with 136 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/03/GHSA-5ccf-884p-4jjq/GHSA-5ccf-884p-4jjq.json → advisories/github-reviewed/2025/03/GHSA-5ccf-884p-4jjq/GHSA-5ccf-884p-4jjq.json
+48 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5ccf-884p-4jjq",
"modified": "2025-03-20T12:32:51Z",
"modified": "2025-03-21T03:38:57Z",
"published": "2025-03-20T12:32:51Z",
"aliases": [
"CVE-2024-9840"
],
"summary": "Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability",
"details": "A Denial of Service (DoS) vulnerability exists in open-webui/open-webui version 0.3.21. This vulnerability affects multiple endpoints, including `/ollama/models/upload`, `/audio/api/v1/transcriptions`, and `/rag/api/v1/doc`. The application processes multipart boundaries without authentication, leading to resource exhaustion. By appending additional characters to the multipart boundary, an attacker can cause the server to parse each byte of the boundary, ultimately leading to service unavailability. This vulnerability can be exploited remotely, resulting in high CPU and memory usage, and rendering the service inaccessible to legitimate users.",
"severity": [
{
@@ -13,12 +14,55 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "open-webui"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.3.21"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.3.21"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9840"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/9178f09e-4d4f-4a5b-bc32-cada7445b03c"
@@ -29,8 +73,8 @@
"CWE-400"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T03:38:57Z",
"nvd_published_at": "2025-03-20T10:15:50Z"
}
}
advisories/unreviewed/2025/03/GHSA-6gmf-2369-c76c/GHSA-6gmf-2369-c76c.json → advisories/github-reviewed/2025/03/GHSA-6gmf-2369-c76c/GHSA-6gmf-2369-c76c.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6gmf-2369-c76c",
"modified": "2025-03-20T12:32:51Z",
"modified": "2025-03-21T03:38:21Z",
"published": "2025-03-20T12:32:51Z",
"aliases": [
"CVE-2024-9340"
],
"summary": "ZenML unauthenticated DoS via Multipart Boundry",
"details": "A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "zenml"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.68.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -23,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/zenml-io/zenml/commit/cba152eb9ca3071c8372b0b91c02d9d3351de48d"
},
{
"type": "PACKAGE",
"url": "https://github.com/zenml-io/zenml"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/c9200654-7dc0-4c1d-8573-ab79a87fb4f6"
@@ -33,8 +58,8 @@
"CWE-400"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T03:38:21Z",
"nvd_published_at": "2025-03-20T10:15:48Z"
}
}
advisories/unreviewed/2025/03/GHSA-747f-ww56-4q4h/GHSA-747f-ww56-4q4h.json → advisories/github-reviewed/2025/03/GHSA-747f-ww56-4q4h/GHSA-747f-ww56-4q4h.json
+30 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-747f-ww56-4q4h",
"modified": "2025-03-20T12:32:51Z",
"modified": "2025-03-21T03:38:41Z",
"published": "2025-03-20T12:32:51Z",
"aliases": [
"CVE-2024-9701"
],
"summary": "Kedro deserialization vulnerability",
"details": "A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "kedro"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.19.9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -21,7 +42,11 @@
},
{
"type": "WEB",
"url": "https://github.com/kedro-org/kedro/commit/d79fa51de55ac0ccb58cce1a482df1b445f0fe7c"
"url": "https://github.com/kedro-org/kedro/commit/66e5e074b2789469550370f370c8b486f638d975"
},
{
"type": "PACKAGE",
"url": "https://github.com/kedro-org/kedro"
},
{
"type": "WEB",
@@ -33,8 +58,8 @@
"CWE-502"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T03:38:41Z",
"nvd_published_at": "2025-03-20T10:15:49Z"
}
}
advisories/unreviewed/2025/03/GHSA-w6hh-w36c-vxmw/GHSA-w6hh-w36c-vxmw.json → advisories/github-reviewed/2025/03/GHSA-w6hh-w36c-vxmw/GHSA-w6hh-w36c-vxmw.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w6hh-w36c-vxmw",
"modified": "2025-03-20T12:32:51Z",
"modified": "2025-03-21T03:39:11Z",
"published": "2025-03-20T12:32:51Z",
"aliases": [
"CVE-2024-9900"
],
"summary": "LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality",
"details": "mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mudler/LocalAI"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.22.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -23,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/mudler/localai/commit/a1634b219a4e52813e70ff07e6376a01449c4515"
},
{
"type": "PACKAGE",
"url": "https://github.com/mudler/LocalAI"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68"
@@ -33,8 +58,8 @@
"CWE-115"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T03:39:10Z",
"nvd_published_at": "2025-03-20T10:15:50Z"
}
}