netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-mp9m-g7qj-6vqr
GHSA-fqfg-c577-2vc3
GHSA-5g66-93qv-565j
GHSA-6j8f-88mh-r9vq
GHSA-vw6x-c5rg-jmjp
GHSA-x2fr-vj74-5h35
GHSA-5g66-93qv-565j
GHSA-6j8f-88mh-r9vq
GHSA-vw6x-c5rg-jmjp
GHSA-x2fr-vj74-5h35
This commit is contained in:
advisory-database[bot]
2024-10-25 21:47:52 +00:00
parent cc576cc8fb
commit 21008afbff
10 changed files with 250 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2020/10/GHSA-mp9m-g7qj-6vqr/GHSA-mp9m-g7qj-6vqr.json
+13 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mp9m-g7qj-6vqr",
"modified": "2024-04-29T09:50:37Z",
"modified": "2024-10-25T21:47:34Z",
"published": "2020-10-27T20:30:48Z",
"aliases": [
"CVE-2020-15278"
@@ -9,7 +9,14 @@
"summary": "Unauthorized privilege escalation in Mod module",
"details": "### Impact\nAn unauthorized privilege escalation exploit has been discovered in the Mod module: this exploit allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition that is beyond that user's control. By abusing this exploit, it's possible to perform destructive actions within the guild the user has high privileges in.\n\n### Patches\nThis exploit has been fixed on version & ``3.4.1``.\n\n### Workarounds\nUnloading the Mod module with ``unload mod`` __or__, disabling the ``massban`` command with ``command disable global massban`` can render this exploit not accessible. We still highly recommend updating to ``3.4.1`` to completely patch this issue.\n\n### References\n* https://github.com/Cog-Creators/Red-DiscordBot/commit/726bfd38adfdfaef760412a68e01447b470f438b\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Cog-Creators/Red-DiscordBot](https://github.com/Cog-Creators/Red-DiscordBot)\n* Over on our [Discord server](https://discord.gg/red)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"
}
],
"affected": [
{
@@ -52,6 +59,10 @@
{
"type": "WEB",
"url": "https://github.com/Cog-Creators/Red-DiscordBot/releases/tag/3.4.1"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/red-discordbot/PYSEC-2020-267.yaml"
}
],
"database_specific": {
advisories/github-reviewed/2022/09/GHSA-fqfg-c577-2vc3/GHSA-fqfg-c577-2vc3.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fqfg-c577-2vc3",
"modified": "2022-09-30T23:04:02Z",
"modified": "2024-10-25T21:46:23Z",
"published": "2022-09-30T00:00:20Z",
"aliases": [
"CVE-2022-3364"
@@ -12,6 +12,10 @@
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
advisories/github-reviewed/2024/10/GHSA-5g66-93qv-565j/GHSA-5g66-93qv-565j.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5g66-93qv-565j",
"modified": "2024-10-25T21:46:34Z",
"published": "2024-10-25T21:31:27Z",
"aliases": [
"CVE-2024-48222"
],
"summary": "SQL injection in funadmin",
"details": "Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "funadmin/funadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.0.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48222"
},
{
"type": "WEB",
"url": "https://github.com/funadmin/funadmin/issues/22"
},
{
"type": "PACKAGE",
"url": "https://github.com/funadmin/funadmin"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-10-25T21:46:34Z",
"nvd_published_at": "2024-10-25T21:15:03Z"
}
}
advisories/github-reviewed/2024/10/GHSA-6j8f-88mh-r9vq/GHSA-6j8f-88mh-r9vq.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6j8f-88mh-r9vq",
"modified": "2024-10-25T21:47:13Z",
"published": "2024-10-25T21:31:27Z",
"aliases": [
"CVE-2024-48224"
],
"summary": "SQL injection in funadmin",
"details": "Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "funadmin/funadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.0.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48224"
},
{
"type": "WEB",
"url": "https://github.com/funadmin/funadmin/issues/24"
},
{
"type": "PACKAGE",
"url": "https://github.com/funadmin/funadmin"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-10-25T21:47:13Z",
"nvd_published_at": "2024-10-25T21:15:03Z"
}
}
advisories/github-reviewed/2024/10/GHSA-vw6x-c5rg-jmjp/GHSA-vw6x-c5rg-jmjp.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vw6x-c5rg-jmjp",
"modified": "2024-10-25T21:47:29Z",
"published": "2024-10-25T21:31:27Z",
"aliases": [
"CVE-2024-48225"
],
"summary": "SQL injection in funadmin",
"details": "Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "funadmin/funadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.0.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48225"
},
{
"type": "WEB",
"url": "https://github.com/funadmin/funadmin/issues/25"
},
{
"type": "PACKAGE",
"url": "https://github.com/funadmin/funadmin"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-10-25T21:47:29Z",
"nvd_published_at": "2024-10-25T21:15:03Z"
}
}
advisories/github-reviewed/2024/10/GHSA-x2fr-vj74-5h35/GHSA-x2fr-vj74-5h35.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x2fr-vj74-5h35",
"modified": "2024-10-25T21:46:55Z",
"published": "2024-10-25T21:31:27Z",
"aliases": [
"CVE-2024-48223"
],
"summary": "SQL injection in funadmin",
"details": "Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "funadmin/funadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.0.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48223"
},
{
"type": "WEB",
"url": "https://github.com/funadmin/funadmin/issues/23"
},
{
"type": "PACKAGE",
"url": "https://github.com/funadmin/funadmin"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-10-25T21:46:55Z",
"nvd_published_at": "2024-10-25T21:15:03Z"
}
}
advisories/unreviewed/2024/10/GHSA-5g66-93qv-565j/GHSA-5g66-93qv-565j.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5g66-93qv-565j",
"modified": "2024-10-25T21:31:27Z",
"published": "2024-10-25T21:31:27Z",
"aliases": [
"CVE-2024-48222"
],
"details": "Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48222"
},
{
"type": "WEB",
"url": "https://github.com/funadmin/funadmin/issues/22"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-25T21:15:03Z"
}
}
advisories/unreviewed/2024/10/GHSA-6j8f-88mh-r9vq/GHSA-6j8f-88mh-r9vq.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6j8f-88mh-r9vq",
"modified": "2024-10-25T21:31:27Z",
"published": "2024-10-25T21:31:27Z",
"aliases": [
"CVE-2024-48224"
],
"details": "Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48224"
},
{
"type": "WEB",
"url": "https://github.com/funadmin/funadmin/issues/24"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-25T21:15:03Z"
}
}
advisories/unreviewed/2024/10/GHSA-vw6x-c5rg-jmjp/GHSA-vw6x-c5rg-jmjp.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vw6x-c5rg-jmjp",
"modified": "2024-10-25T21:31:27Z",
"published": "2024-10-25T21:31:27Z",
"aliases": [
"CVE-2024-48225"
],
"details": "Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48225"
},
{
"type": "WEB",
"url": "https://github.com/funadmin/funadmin/issues/25"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-25T21:15:03Z"
}
}
advisories/unreviewed/2024/10/GHSA-x2fr-vj74-5h35/GHSA-x2fr-vj74-5h35.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x2fr-vj74-5h35",
"modified": "2024-10-25T21:31:27Z",
"published": "2024-10-25T21:31:27Z",
"aliases": [
"CVE-2024-48223"
],
"details": "Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48223"
},
{
"type": "WEB",
"url": "https://github.com/funadmin/funadmin/issues/23"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-25T21:15:03Z"
}
}