Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-04 05:16:09 +00:00
parent a115a703ec
commit 18c0cf8019
944 changed files with 1431 additions and 4293 deletions
@@ -81,9 +81,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:29:59Z",
@@ -93,9 +93,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:35:31Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Integer underflow in Frontier",
  "details": "### Impact\n\nA bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and production WebAssembly binaries), the impact is limited as it can only cause a normal EVM out-of-gas. It is recommended that you apply the patch as soon as possible.\n\nIf you do not use MODEXP precompile in your runtime, then you are not impacted.\n\n### Patches\n\nPatches are applied in PR #549.\n\n### Workarounds\n\nNone.\n\n### References\n\nPatch PR: #549\n\n### Credits\n\nThanks to SR-Labs for discovering the security vulnerability, and thanks to PureStake team for the patches.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in the [Frontier repo](https://github.com/paritytech/frontier)\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -94,9 +94,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-01T10:51:17Z",
@@ -108,9 +108,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-29T16:41:53Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-593m-55hh-j8gv",
  "modified": "2024-10-04T16:32:02Z",
  "published": "2024-10-03T18:26:53Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Sentry SDK Prototype Pollution gadget in JavaScript SDKs",
  "details": "### Impact\nIn case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.\n\n> [!NOTE]\n> This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk.\n\n### Patches\nThe issue was patched in all Sentry JavaScript SDKs starting from the [8.33.0](https://github.com/getsentry/sentry-javascript/releases/tag/8.33.0) version.\nAlso, the fix was backported to SDK v7 in [7.119.1](https://github.com/getsentry/sentry-javascript/releases/tag/7.119.1).\n\n### References\n* [Prototype Pollution](https://portswigger.net/web-security/prototype-pollution)\n* [Prototype Pollution gadgets](https://portswigger.net/web-security/prototype-pollution#prototype-pollution-gadgets)\n* [sentry-javascript#13838](https://github.com/getsentry/sentry-javascript/pull/13838)",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-5rxp-2rhr-qwqv",
  "modified": "2024-10-14T20:55:49Z",
  "published": "2024-10-14T20:55:49Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Session fixation in Elytron SAML adapters",
  "details": "A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.",
  "severity": [
@@ -8,9 +8,7 @@
  ],
  "summary": "cookie accepts cookie name, path, and domain with out of bounds characters",
  "details": "### Impact\n\nThe cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, `serialize(\"userName=<script>alert('XSS3')</script>; Max-Age=2592000; a\", value)` would result in `\"userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test\"`, setting `userName` cookie to `<script>` and ignoring `value`.\n\nA similar escape can be used for `path` and `domain`, which could be abused to alter other fields of the cookie.\n\n### Patches\n\nUpgrade to 0.7.0, which updates the validation for `name`, `path`, and `domain`.\n\n### Workarounds\n\nAvoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.\n\n### References\n\n* https://github.com/jshttp/cookie/pull/167",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-vv6c-69r6-chg9",
  "modified": "2024-10-14T20:30:25Z",
  "published": "2024-10-14T20:30:25Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly",
  "details": "### Impact\nWhen using the recommended \"best-effort\" mode, Go-Landlock did not restrict the TCP bind() and connect() operations any more when they were requested.  This affects Go-Landlock users to whom both of the following conditions apply:\n\n* They use Landlock rulesets that are supposed to restrict networking (through `landlock.V4`, `landlock.V5`, or self-configured).\n* These Landlock rulesets are used in best-effort mode.\n\nTypically, affected code uses the Go-Landlock API like this (the crucial part being the combination of `V4`/`V5` and `.BestEffort()`):\n\n```\nerr := landlock.V5.BestEffort().Restrict(...)\n```\n\n* This is a bug in the Go-Landlock library and does not affect programs that use Landlock via C or other language bindings.\n* The bug only affects networking restrictions. File system restrictions continue to work as expected.\n\n### Patches\nPatched in: https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b\nUsers should upgrade to: v0.0.0-20241013234402-fb3ad845df46\n\nGo package dependencies can be updated using `go get -u` from the project directory.\n\nProjects on Github might get notified by Dependabot, once this advisory is public.\n\n### Workarounds\nNone.\n\n### References\nCurrently none.\n\n[The existing users of Go-Landlock on Github](https://pkg.go.dev/github.com/landlock-lsm/go-landlock/landlock?tab=importedby) have the following bugs filed:\n* https://github.com/Foxboron/ssh-the-planet/issues/1\n* https://github.com/ngergs/websrv/issues/15\n* https://github.com/pufferffish/wireproxy/issues/142",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -47,9 +43,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-14T20:30:25Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-w8gr-xwp4-r9f7",
  "modified": "2024-10-14T20:55:22Z",
  "published": "2024-10-14T20:55:22Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Vulnerable Redirect URI Validation Results in Open Redirect",
  "details": "A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-xgfv-xpx8-qhcr",
  "modified": "2024-10-14T20:54:52Z",
  "published": "2024-10-14T20:54:52Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak",
  "details": "A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-xmmm-jw76-q7vg",
  "modified": "2024-10-14T20:56:43Z",
  "published": "2024-10-14T20:56:43Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "One Time Passcode (OTP) is valid longer than expiration timeSeverity",
  "details": "A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.",
  "severity": [
@@ -7,12 +7,8 @@
    "CVE-2018-4302"
  ],
  "details": "A null pointer dereference was addressed with improved validation. This issue is fixed in macOS High Sierra 10.13, iCloud for Windows 7.0, watchOS 4, iOS 11, iTunes 12.7 for Windows. Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2021-45259"
  ],
  "details": "An Invalid pointer reference vulnerability exists in gpac 1.1.0 via the gf_svg_node_del function, which causes a segmentation fault and application crash.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2021-20318"
  ],
  "details": "The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2021-45266"
  ],
  "details": "A null pointer dereference vulnerability exists in gpac 1.1.0 via the lsr_read_anim_values_ex function, which causes a segmentation fault and application crash.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2021-43629"
  ],
  "details": "Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in admin_home.php.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2021-43628"
  ],
  "details": "Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the email parameter in hms-staff.php.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
--- a/Show More
+++ b/Show More