netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3m36-mjwj-352c
GHSA-c533-c843-67h8
GHSA-gxxj-g9v8-w28p
GHSA-r67r-42wx-c8r7
GHSA-vfgc-c76h-mwh4
GHSA-3m36-mjwj-352c
GHSA-c533-c843-67h8
This commit is contained in:
advisory-database[bot]
2024-05-15 20:53:13 +00:00
parent ebf655fb80
commit 1d4396e0c8
7 changed files with 679 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/02/GHSA-3m36-mjwj-352c/GHSA-3m36-mjwj-352c.json
+202
View File
@@ -0,0 +1,202 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3m36-mjwj-352c",
"modified": "2024-05-15T20:51:56Z",
"published": "2022-02-12T00:00:47Z",
"aliases": [
"CVE-2020-13672"
],
"summary": "Drupal core Cross-site Scripting (XSS) vulnerability",
"details": "Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.80"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.9.14"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.12"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.1.0"
},
{
"fixed": "9.1.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.80"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.9.14"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.12"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.1.0"
},
{
"fixed": "9.1.7"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13672"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13672.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13672.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2021-002"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-05-15T20:51:56Z",
"nvd_published_at": "2022-02-11T16:15:00Z"
}
}
advisories/github-reviewed/2022/02/GHSA-c533-c843-67h8/GHSA-c533-c843-67h8.json
+164
View File
@@ -0,0 +1,164 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c533-c843-67h8",
"modified": "2024-05-15T20:52:03Z",
"published": "2022-02-12T00:00:47Z",
"aliases": [
"CVE-2020-13669"
],
"summary": "Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor",
"details": "Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.8.10"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.9.0"
},
{
"fixed": "8.9.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.8.10"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.9.0"
},
{
"fixed": "8.9.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.6"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13669"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13669.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13669.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2020-010"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-05-15T20:52:03Z",
"nvd_published_at": "2022-02-11T16:15:00Z"
}
}
advisories/github-reviewed/2024/05/GHSA-gxxj-g9v8-w28p/GHSA-gxxj-g9v8-w28p.json
+118
View File
@@ -0,0 +1,118 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gxxj-g9v8-w28p",
"modified": "2024-05-15T20:50:24Z",
"published": "2024-05-15T20:50:24Z",
"aliases": [
],
"summary": "Drupal core Arbitrary PHP code execution",
"details": "The Drupal project uses the PEAR Archive_Tar library. The PEAR Archive_Tar library has released a security update that impacts Drupal. For more information please see:\nCVE-2020-28948\nCVE-2020-28949\n\nMultiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them.\n\nTo mitigate this issue, prevent untrusted users from uploading .tar, .tar.gz, .bz2, or .tlz files.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.75"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.8.12"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.9.0"
},
{
"fixed": "8.9.10"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.9"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2020-11-25.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2020-013"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-05-15T20:50:24Z",
"nvd_published_at": null
}
}
advisories/github-reviewed/2024/05/GHSA-r67r-42wx-c8r7/GHSA-r67r-42wx-c8r7.json
+96
View File
@@ -0,0 +1,96 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r67r-42wx-c8r7",
"modified": "2024-05-15T20:52:44Z",
"published": "2024-05-15T20:52:43Z",
"aliases": [
],
"summary": "Drupal External URL injection through URL aliases leading to Open Redirect",
"details": "The path module in Drupal allows users with the 'administer paths' to create pretty URLs for content.\nIn certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0"
},
{
"fixed": "7.60"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.5.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.6.0"
},
{
"fixed": "8.6.2"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2018-10-17-2.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/drupal"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2018-006"
}
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-05-15T20:52:43Z",
"nvd_published_at": null
}
}
advisories/github-reviewed/2024/05/GHSA-vfgc-c76h-mwh4/GHSA-vfgc-c76h-mwh4.json
+99
View File
@@ -0,0 +1,99 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vfgc-c76h-mwh4",
"modified": "2024-05-15T20:51:25Z",
"published": "2024-05-15T20:51:25Z",
"aliases": [
],
"summary": "Drupal core Cross-Site Scripting (XSS) vulnerabilities",
"details": "The Drupal project uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.\n\nVulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.9.18"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.1.0"
},
{
"fixed": "9.1.12"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.2.0"
},
{
"fixed": "9.2.4"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2021-05-26.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2021-005"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-05-15T20:51:25Z",
"nvd_published_at": null
}
}
advisories/unreviewed/2022/02/GHSA-3m36-mjwj-352c/GHSA-3m36-mjwj-352c.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3m36-mjwj-352c",
"modified": "2022-04-13T00:01:08Z",
"published": "2022-02-12T00:00:47Z",
"aliases": [
"CVE-2020-13672"
],
"details": "Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13672"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2021-002"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-11T16:15:00Z"
}
}
advisories/unreviewed/2022/02/GHSA-c533-c843-67h8/GHSA-c533-c843-67h8.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c533-c843-67h8",
"modified": "2022-02-18T00:00:44Z",
"published": "2022-02-12T00:00:47Z",
"aliases": [
"CVE-2020-13669"
],
"details": "Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13669"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2020-010"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-11T16:15:00Z"
}
}