netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-87vg-5pgx-pggh
GHSA-mwc7-64wg-pgvj
GHSA-p3j6-f45h-hw5f
GHSA-p3j6-f45h-hw5f
This commit is contained in:
advisory-database[bot]
2024-04-12 21:25:16 +00:00
parent a5446a58b0
commit 1fd6d79073
4 changed files with 127 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-87vg-5pgx-pggh/GHSA-87vg-5pgx-pggh.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-87vg-5pgx-pggh",
"modified": "2023-07-19T23:55:10Z",
"modified": "2024-04-12T21:24:22Z",
"published": "2022-05-13T01:07:04Z",
"aliases": [
"CVE-2018-1263"
@@ -40,6 +40,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1263"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-integration-extensions/commit/d10f537283d90eabd28af57ac97f860a3913bf9b"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-projects/spring-integration"
advisories/github-reviewed/2024/04/GHSA-mwc7-64wg-pgvj/GHSA-mwc7-64wg-pgvj.json
+61
View File
@@ -0,0 +1,61 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mwc7-64wg-pgvj",
"modified": "2024-04-12T21:23:16Z",
"published": "2024-04-12T21:23:16Z",
"aliases": [
"CVE-2024-32005"
],
"summary": "NiceGUI allows potential access to local file system",
"details": "NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the `/_nicegui/{__version__}/resources/{key}/{path:path}` route. \n\nAs a result any file on the backend filesystem which the web server has access to can be read by an attacker with access to the NiceUI leaflet website. \n\nThis vulnerability has been addressed in version 1.4.21. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nicegui"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.4.6"
},
{
"fixed": "1.4.21"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mwc7-64wg-pgvj"
},
{
"type": "WEB",
"url": "https://github.com/zauberzeug/nicegui/commit/ed12eb14f2a6c48b388a05c04b3c5a107ea9d330"
},
{
"type": "PACKAGE",
"url": "https://github.com/zauberzeug/nicegui"
}
],
"database_specific": {
"cwe_ids": [
"CWE-23"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-12T21:23:16Z",
"nvd_published_at": null
}
}
advisories/github-reviewed/2024/04/GHSA-p3j6-f45h-hw5f/GHSA-p3j6-f45h-hw5f.json
+61
View File
@@ -0,0 +1,61 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p3j6-f45h-hw5f",
"modified": "2024-04-12T21:23:30Z",
"published": "2024-04-12T06:33:24Z",
"aliases": [
"CVE-2024-30850"
],
"summary": "tiagorlampert CHAOS vulnerable to command injections",
"details": "An issue in tiagorlampert CHAOS v5.0.1 allows a remote attacker to execute arbitrary code via the BuildClient function within client_service.go",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/tiagorlampert/CHAOS"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.01"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30850"
},
{
"type": "WEB",
"url": "https://blog.chebuya.com/posts/remote-code-execution-on-chaos-rat-via-spoofed-agents"
},
{
"type": "PACKAGE",
"url": "https://github.com/tiagorlampert/CHAOS"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-12T21:23:30Z",
"nvd_published_at": "2024-04-12T06:15:06Z"
}
}
advisories/unreviewed/2024/04/GHSA-p3j6-f45h-hw5f/GHSA-p3j6-f45h-hw5f.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p3j6-f45h-hw5f",
"modified": "2024-04-12T06:33:24Z",
"published": "2024-04-12T06:33:24Z",
"aliases": [
"CVE-2024-30850"
],
"details": "An issue in tiagorlampert CHAOS v5.0.1 allows a remote attacker to execute arbitrary code via the BuildClient function within client_service.go",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30850"
},
{
"type": "WEB",
"url": "https://blog.chebuya.com/posts/remote-code-execution-on-chaos-rat-via-spoofed-agents"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-12T06:15:06Z"
}
}