diff --git a/advisories/github-reviewed/2022/05/GHSA-j2hg-w4p4-6rvm/GHSA-j2hg-w4p4-6rvm.json b/advisories/github-reviewed/2022/05/GHSA-j2hg-w4p4-6rvm/GHSA-j2hg-w4p4-6rvm.json new file mode 100644 index 00000000000..b863ea3ede7 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-j2hg-w4p4-6rvm/GHSA-j2hg-w4p4-6rvm.json @@ -0,0 +1,81 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j2hg-w4p4-6rvm", + "modified": "2024-06-11T19:29:36Z", + "published": "2022-05-17T04:54:13Z", + "aliases": [ + "CVE-2014-0808" + ], + "summary": "EC-CUBE vulnerable to authorization bypass", + "details": "Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "ec-cube/ec-cube" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.11.0" + }, + { + "fixed": "2.12.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0808" + }, + { + "type": "PACKAGE", + "url": "https://github.com/EC-CUBE/ec-cube" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/jp/JVN15637138" + }, + { + "type": "WEB", + "url": "https://jvndb.jvn.jp/jvndb/JVNDB-2024-000054" + }, + { + "type": "WEB", + "url": "http://jvn.jp/en/jp/JVN51770585" + }, + { + "type": "WEB", + "url": "http://jvn.jp/en/jp/JVN51770585/index.html" + }, + { + "type": "WEB", + "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000006" + }, + { + "type": "WEB", + "url": "http://www.ec-cube.net/info/weakness/weakness.php?id=57" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-06-11T19:29:36Z", + "nvd_published_at": "2014-01-22T21:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-5jqc-qj57-4hrc/GHSA-5jqc-qj57-4hrc.json b/advisories/github-reviewed/2024/06/GHSA-5jqc-qj57-4hrc/GHSA-5jqc-qj57-4hrc.json similarity index 56% rename from advisories/unreviewed/2024/06/GHSA-5jqc-qj57-4hrc/GHSA-5jqc-qj57-4hrc.json rename to advisories/github-reviewed/2024/06/GHSA-5jqc-qj57-4hrc/GHSA-5jqc-qj57-4hrc.json index 381de064388..fb2f3ce4d65 100644 --- a/advisories/unreviewed/2024/06/GHSA-5jqc-qj57-4hrc/GHSA-5jqc-qj57-4hrc.json +++ b/advisories/github-reviewed/2024/06/GHSA-5jqc-qj57-4hrc/GHSA-5jqc-qj57-4hrc.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-5jqc-qj57-4hrc", - "modified": "2024-06-11T15:31:08Z", + "modified": "2024-06-11T19:29:48Z", "published": "2024-06-04T21:32:20Z", "aliases": [ "CVE-2024-36857" ], + "summary": "Jan path traversal vulnerability", "details": "Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "@janhq/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.1.11" + } + ] + } + ] + } ], "references": [ { @@ -24,15 +43,19 @@ { "type": "WEB", "url": "https://github.com/HackAllSec/CVEs/tree/main/Jan%20AFR%20vulnerability" + }, + { + "type": "PACKAGE", + "url": "https://github.com/janhq/jan" } ], "database_specific": { "cwe_ids": [ - + "CWE-22" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-06-11T19:29:48Z", "nvd_published_at": "2024-06-04T19:20:14Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/06/GHSA-7jmw-8259-q9jx/GHSA-7jmw-8259-q9jx.json b/advisories/github-reviewed/2024/06/GHSA-7jmw-8259-q9jx/GHSA-7jmw-8259-q9jx.json new file mode 100644 index 00000000000..169a0511094 --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-7jmw-8259-q9jx/GHSA-7jmw-8259-q9jx.json @@ -0,0 +1,104 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7jmw-8259-q9jx", + "modified": "2024-06-11T19:29:43Z", + "published": "2024-06-11T19:29:43Z", + "aliases": [ + + ], + "summary": "Traefik has unexpected behavior with IPv4-mapped IPv6 addresses", + "details": "### Impact\n\nThere is a vulnerability in [Go managing various Is methods (IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses](https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ).\n\nThey didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms.\n\n### References\n\n- [CVE-2024-24790](https://www.cve.org/CVERecord?id=CVE-2024-24790)\n\n### Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.4\n- https://github.com/traefik/traefik/releases/tag/v3.0.2\n\n### Workarounds\n\nNo workaround.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/traefik/traefik/v3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0-beta3" + }, + { + "fixed": "3.0.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/traefik/traefik/v2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.11.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/traefik/traefik" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.11.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/security/advisories/GHSA-7jmw-8259-q9jx" + }, + { + "type": "PACKAGE", + "url": "https://github.com/traefik/traefik" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v2.11.4" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v3.0.2" + }, + { + "type": "WEB", + "url": "https://www.cve.org/CVERecord?id=CVE-2024-24790" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-180" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-06-11T19:29:43Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/06/GHSA-qg33-x2c5-6p44/GHSA-qg33-x2c5-6p44.json b/advisories/github-reviewed/2024/06/GHSA-qg33-x2c5-6p44/GHSA-qg33-x2c5-6p44.json new file mode 100644 index 00000000000..24bfed0fe39 --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-qg33-x2c5-6p44/GHSA-qg33-x2c5-6p44.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qg33-x2c5-6p44", + "modified": "2024-06-11T19:29:16Z", + "published": "2024-06-10T21:30:38Z", + "aliases": [ + "CVE-2024-37014" + ], + "summary": "Langflow remote code execution vulnerability", + "details": "Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the \"POST /api/v1/custom_component\" endpoint and provide a Python script.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "langflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.6.19" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37014" + }, + { + "type": "WEB", + "url": "https://github.com/langflow-ai/langflow/issues/1973" + }, + { + "type": "PACKAGE", + "url": "https://github.com/langflow-ai/langflow" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-913" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-06-11T19:29:16Z", + "nvd_published_at": "2024-06-10T20:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-j2hg-w4p4-6rvm/GHSA-j2hg-w4p4-6rvm.json b/advisories/unreviewed/2022/05/GHSA-j2hg-w4p4-6rvm/GHSA-j2hg-w4p4-6rvm.json deleted file mode 100644 index 547b1615c95..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-j2hg-w4p4-6rvm/GHSA-j2hg-w4p4-6rvm.json +++ /dev/null @@ -1,59 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-j2hg-w4p4-6rvm", - "modified": "2024-06-11T06:31:46Z", - "published": "2022-05-17T04:54:13Z", - "aliases": [ - "CVE-2014-0808" - ], - "details": "The lfCheckError function in data/class/pages/shopping/LC_Page_Shopping_Multiple.php in LOCKON EC-CUBE 2.11.0 through 2.12.2 allows remote attackers to obtain sensitive shipping information via unspecified vectors.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0808" - }, - { - "type": "WEB", - "url": "https://ec-orange.jp" - }, - { - "type": "WEB", - "url": "https://jvn.jp/en/jp/JVN15637138" - }, - { - "type": "WEB", - "url": "https://jvndb.jvn.jp/jvndb/JVNDB-2024-000054" - }, - { - "type": "WEB", - "url": "http://jvn.jp/en/jp/JVN51770585" - }, - { - "type": "WEB", - "url": "http://jvn.jp/en/jp/JVN51770585/index.html" - }, - { - "type": "WEB", - "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000006" - }, - { - "type": "WEB", - "url": "http://www.ec-cube.net/info/weakness/weakness.php?id=57" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-01-22T21:55:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-qg33-x2c5-6p44/GHSA-qg33-x2c5-6p44.json b/advisories/unreviewed/2024/06/GHSA-qg33-x2c5-6p44/GHSA-qg33-x2c5-6p44.json deleted file mode 100644 index 79138273c12..00000000000 --- a/advisories/unreviewed/2024/06/GHSA-qg33-x2c5-6p44/GHSA-qg33-x2c5-6p44.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-qg33-x2c5-6p44", - "modified": "2024-06-10T21:30:38Z", - "published": "2024-06-10T21:30:38Z", - "aliases": [ - "CVE-2024-37014" - ], - "details": "Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the \"POST /api/v1/custom_component\" endpoint and provide a Python script.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37014" - }, - { - "type": "WEB", - "url": "https://github.com/langflow-ai/langflow/issues/1973" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-06-10T20:15:15Z" - } -} \ No newline at end of file