netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-j2hg-w4p4-6rvm
GHSA-5jqc-qj57-4hrc
GHSA-7jmw-8259-q9jx
GHSA-qg33-x2c5-6p44
GHSA-j2hg-w4p4-6rvm
GHSA-qg33-x2c5-6p44
This commit is contained in:
advisory-database[bot]
2024-06-11 19:30:44 +00:00
parent 87c63bf22b
commit 1f107541b6
6 changed files with 274 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-j2hg-w4p4-6rvm/GHSA-j2hg-w4p4-6rvm.json
+81
View File
@@ -0,0 +1,81 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j2hg-w4p4-6rvm",
"modified": "2024-06-11T19:29:36Z",
"published": "2022-05-17T04:54:13Z",
"aliases": [
"CVE-2014-0808"
],
"summary": "EC-CUBE vulnerable to authorization bypass",
"details": "Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.11.0"
},
{
"fixed": "2.12.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0808"
},
{
"type": "PACKAGE",
"url": "https://github.com/EC-CUBE/ec-cube"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN15637138"
},
{
"type": "WEB",
"url": "https://jvndb.jvn.jp/jvndb/JVNDB-2024-000054"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN51770585"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN51770585/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000006"
},
{
"type": "WEB",
"url": "http://www.ec-cube.net/info/weakness/weakness.php?id=57"
}
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-06-11T19:29:36Z",
"nvd_published_at": "2014-01-22T21:55:00Z"
}
}
advisories/unreviewed/2024/06/GHSA-5jqc-qj57-4hrc/GHSA-5jqc-qj57-4hrc.json → advisories/github-reviewed/2024/06/GHSA-5jqc-qj57-4hrc/GHSA-5jqc-qj57-4hrc.json
+28 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5jqc-qj57-4hrc",
"modified": "2024-06-11T15:31:08Z",
"modified": "2024-06-11T19:29:48Z",
"published": "2024-06-04T21:32:20Z",
"aliases": [
"CVE-2024-36857"
],
"summary": "Jan path traversal vulnerability",
"details": "Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@janhq/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.11"
}
]
}
]
}
],
"references": [
{
@@ -24,15 +43,19 @@
{
"type": "WEB",
"url": "https://github.com/HackAllSec/CVEs/tree/main/Jan%20AFR%20vulnerability"
},
{
"type": "PACKAGE",
"url": "https://github.com/janhq/jan"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-06-11T19:29:48Z",
"nvd_published_at": "2024-06-04T19:20:14Z"
}
}
advisories/github-reviewed/2024/06/GHSA-7jmw-8259-q9jx/GHSA-7jmw-8259-q9jx.json
+104
View File
@@ -0,0 +1,104 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7jmw-8259-q9jx",
"modified": "2024-06-11T19:29:43Z",
"published": "2024-06-11T19:29:43Z",
"aliases": [
],
"summary": "Traefik has unexpected behavior with IPv4-mapped IPv6 addresses",
"details": "### Impact\n\nThere is a vulnerability in [Go managing various Is methods (IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses](https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ).\n\nThey didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms.\n\n### References\n\n- [CVE-2024-24790](https://www.cve.org/CVERecord?id=CVE-2024-24790)\n\n### Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.4\n- https://github.com/traefik/traefik/releases/tag/v3.0.2\n\n### Workarounds\n\nNo workaround.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v3"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0-beta3"
},
{
"fixed": "3.0.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v2"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.11.4"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.11.4"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-7jmw-8259-q9jx"
},
{
"type": "PACKAGE",
"url": "https://github.com/traefik/traefik"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/releases/tag/v2.11.4"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/releases/tag/v3.0.2"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24790"
}
],
"database_specific": {
"cwe_ids": [
"CWE-180"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-06-11T19:29:43Z",
"nvd_published_at": null
}
}
advisories/github-reviewed/2024/06/GHSA-qg33-x2c5-6p44/GHSA-qg33-x2c5-6p44.json
+61
View File
@@ -0,0 +1,61 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qg33-x2c5-6p44",
"modified": "2024-06-11T19:29:16Z",
"published": "2024-06-10T21:30:38Z",
"aliases": [
"CVE-2024-37014"
],
"summary": "Langflow remote code execution vulnerability",
"details": "Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the \"POST /api/v1/custom_component\" endpoint and provide a Python script.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "langflow"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.6.19"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37014"
},
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/issues/1973"
},
{
"type": "PACKAGE",
"url": "https://github.com/langflow-ai/langflow"
}
],
"database_specific": {
"cwe_ids": [
"CWE-913"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-06-11T19:29:16Z",
"nvd_published_at": "2024-06-10T20:15:15Z"
}
}
advisories/unreviewed/2022/05/GHSA-j2hg-w4p4-6rvm/GHSA-j2hg-w4p4-6rvm.json
-59
View File
@@ -1,59 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j2hg-w4p4-6rvm",
"modified": "2024-06-11T06:31:46Z",
"published": "2022-05-17T04:54:13Z",
"aliases": [
"CVE-2014-0808"
],
"details": "The lfCheckError function in data/class/pages/shopping/LC_Page_Shopping_Multiple.php in LOCKON EC-CUBE 2.11.0 through 2.12.2 allows remote attackers to obtain sensitive shipping information via unspecified vectors.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0808"
},
{
"type": "WEB",
"url": "https://ec-orange.jp"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN15637138"
},
{
"type": "WEB",
"url": "https://jvndb.jvn.jp/jvndb/JVNDB-2024-000054"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN51770585"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN51770585/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000006"
},
{
"type": "WEB",
"url": "http://www.ec-cube.net/info/weakness/weakness.php?id=57"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-01-22T21:55:00Z"
}
}
advisories/unreviewed/2024/06/GHSA-qg33-x2c5-6p44/GHSA-qg33-x2c5-6p44.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qg33-x2c5-6p44",
"modified": "2024-06-10T21:30:38Z",
"published": "2024-06-10T21:30:38Z",
"aliases": [
"CVE-2024-37014"
],
"details": "Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the \"POST /api/v1/custom_component\" endpoint and provide a Python script.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37014"
},
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/issues/1973"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-10T20:15:15Z"
}
}