From 21008afbffb2ec3c76c140048164509bbfe996b3 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 25 Oct 2024 21:47:52 +0000 Subject: [PATCH] Publish Advisories GHSA-mp9m-g7qj-6vqr GHSA-fqfg-c577-2vc3 GHSA-5g66-93qv-565j GHSA-6j8f-88mh-r9vq GHSA-vw6x-c5rg-jmjp GHSA-x2fr-vj74-5h35 GHSA-5g66-93qv-565j GHSA-6j8f-88mh-r9vq GHSA-vw6x-c5rg-jmjp GHSA-x2fr-vj74-5h35 --- .../GHSA-mp9m-g7qj-6vqr.json | 15 ++++- .../GHSA-fqfg-c577-2vc3.json | 6 +- .../GHSA-5g66-93qv-565j.json | 58 +++++++++++++++++++ .../GHSA-6j8f-88mh-r9vq.json | 58 +++++++++++++++++++ .../GHSA-vw6x-c5rg-jmjp.json | 58 +++++++++++++++++++ .../GHSA-x2fr-vj74-5h35.json | 58 +++++++++++++++++++ .../GHSA-5g66-93qv-565j.json | 35 ----------- .../GHSA-6j8f-88mh-r9vq.json | 35 ----------- .../GHSA-vw6x-c5rg-jmjp.json | 35 ----------- .../GHSA-x2fr-vj74-5h35.json | 35 ----------- 10 files changed, 250 insertions(+), 143 deletions(-) create mode 100644 advisories/github-reviewed/2024/10/GHSA-5g66-93qv-565j/GHSA-5g66-93qv-565j.json create mode 100644 advisories/github-reviewed/2024/10/GHSA-6j8f-88mh-r9vq/GHSA-6j8f-88mh-r9vq.json create mode 100644 advisories/github-reviewed/2024/10/GHSA-vw6x-c5rg-jmjp/GHSA-vw6x-c5rg-jmjp.json create mode 100644 advisories/github-reviewed/2024/10/GHSA-x2fr-vj74-5h35/GHSA-x2fr-vj74-5h35.json delete mode 100644 advisories/unreviewed/2024/10/GHSA-5g66-93qv-565j/GHSA-5g66-93qv-565j.json delete mode 100644 advisories/unreviewed/2024/10/GHSA-6j8f-88mh-r9vq/GHSA-6j8f-88mh-r9vq.json delete mode 100644 advisories/unreviewed/2024/10/GHSA-vw6x-c5rg-jmjp/GHSA-vw6x-c5rg-jmjp.json delete mode 100644 advisories/unreviewed/2024/10/GHSA-x2fr-vj74-5h35/GHSA-x2fr-vj74-5h35.json diff --git a/advisories/github-reviewed/2020/10/GHSA-mp9m-g7qj-6vqr/GHSA-mp9m-g7qj-6vqr.json b/advisories/github-reviewed/2020/10/GHSA-mp9m-g7qj-6vqr/GHSA-mp9m-g7qj-6vqr.json index 6794ada08d5..23478c78545 100644 --- a/advisories/github-reviewed/2020/10/GHSA-mp9m-g7qj-6vqr/GHSA-mp9m-g7qj-6vqr.json +++ b/advisories/github-reviewed/2020/10/GHSA-mp9m-g7qj-6vqr/GHSA-mp9m-g7qj-6vqr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mp9m-g7qj-6vqr", - "modified": "2024-04-29T09:50:37Z", + "modified": "2024-10-25T21:47:34Z", "published": "2020-10-27T20:30:48Z", "aliases": [ "CVE-2020-15278" @@ -9,7 +9,14 @@ "summary": "Unauthorized privilege escalation in Mod module", "details": "### Impact\nAn unauthorized privilege escalation exploit has been discovered in the Mod module: this exploit allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition that is beyond that user's control. By abusing this exploit, it's possible to perform destructive actions within the guild the user has high privileges in.\n\n### Patches\nThis exploit has been fixed on version & ``3.4.1``.\n\n### Workarounds\nUnloading the Mod module with ``unload mod`` __or__, disabling the ``massban`` command with ``command disable global massban`` can render this exploit not accessible. We still highly recommend updating to ``3.4.1`` to completely patch this issue.\n\n### References\n* https://github.com/Cog-Creators/Red-DiscordBot/commit/726bfd38adfdfaef760412a68e01447b470f438b\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Cog-Creators/Red-DiscordBot](https://github.com/Cog-Creators/Red-DiscordBot)\n* Over on our [Discord server](https://discord.gg/red)", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" + } ], "affected": [ { @@ -52,6 +59,10 @@ { "type": "WEB", "url": "https://github.com/Cog-Creators/Red-DiscordBot/releases/tag/3.4.1" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/red-discordbot/PYSEC-2020-267.yaml" } ], "database_specific": { diff --git a/advisories/github-reviewed/2022/09/GHSA-fqfg-c577-2vc3/GHSA-fqfg-c577-2vc3.json b/advisories/github-reviewed/2022/09/GHSA-fqfg-c577-2vc3/GHSA-fqfg-c577-2vc3.json index fdeee1c7a3a..bc358c828ef 100644 --- a/advisories/github-reviewed/2022/09/GHSA-fqfg-c577-2vc3/GHSA-fqfg-c577-2vc3.json +++ b/advisories/github-reviewed/2022/09/GHSA-fqfg-c577-2vc3/GHSA-fqfg-c577-2vc3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fqfg-c577-2vc3", - "modified": "2022-09-30T23:04:02Z", + "modified": "2024-10-25T21:46:23Z", "published": "2022-09-30T00:00:20Z", "aliases": [ "CVE-2022-3364" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" } ], "affected": [ diff --git a/advisories/github-reviewed/2024/10/GHSA-5g66-93qv-565j/GHSA-5g66-93qv-565j.json b/advisories/github-reviewed/2024/10/GHSA-5g66-93qv-565j/GHSA-5g66-93qv-565j.json new file mode 100644 index 00000000000..ac5ad6b3816 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-5g66-93qv-565j/GHSA-5g66-93qv-565j.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5g66-93qv-565j", + "modified": "2024-10-25T21:46:34Z", + "published": "2024-10-25T21:31:27Z", + "aliases": [ + "CVE-2024-48222" + ], + "summary": "SQL injection in funadmin", + "details": "Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "funadmin/funadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48222" + }, + { + "type": "WEB", + "url": "https://github.com/funadmin/funadmin/issues/22" + }, + { + "type": "PACKAGE", + "url": "https://github.com/funadmin/funadmin" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-10-25T21:46:34Z", + "nvd_published_at": "2024-10-25T21:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-6j8f-88mh-r9vq/GHSA-6j8f-88mh-r9vq.json b/advisories/github-reviewed/2024/10/GHSA-6j8f-88mh-r9vq/GHSA-6j8f-88mh-r9vq.json new file mode 100644 index 00000000000..c43cd30f0cd --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-6j8f-88mh-r9vq/GHSA-6j8f-88mh-r9vq.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6j8f-88mh-r9vq", + "modified": "2024-10-25T21:47:13Z", + "published": "2024-10-25T21:31:27Z", + "aliases": [ + "CVE-2024-48224" + ], + "summary": "SQL injection in funadmin", + "details": "Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "funadmin/funadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48224" + }, + { + "type": "WEB", + "url": "https://github.com/funadmin/funadmin/issues/24" + }, + { + "type": "PACKAGE", + "url": "https://github.com/funadmin/funadmin" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-10-25T21:47:13Z", + "nvd_published_at": "2024-10-25T21:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-vw6x-c5rg-jmjp/GHSA-vw6x-c5rg-jmjp.json b/advisories/github-reviewed/2024/10/GHSA-vw6x-c5rg-jmjp/GHSA-vw6x-c5rg-jmjp.json new file mode 100644 index 00000000000..97ffba25de5 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-vw6x-c5rg-jmjp/GHSA-vw6x-c5rg-jmjp.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vw6x-c5rg-jmjp", + "modified": "2024-10-25T21:47:29Z", + "published": "2024-10-25T21:31:27Z", + "aliases": [ + "CVE-2024-48225" + ], + "summary": "SQL injection in funadmin", + "details": "Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "funadmin/funadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48225" + }, + { + "type": "WEB", + "url": "https://github.com/funadmin/funadmin/issues/25" + }, + { + "type": "PACKAGE", + "url": "https://github.com/funadmin/funadmin" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-10-25T21:47:29Z", + "nvd_published_at": "2024-10-25T21:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-x2fr-vj74-5h35/GHSA-x2fr-vj74-5h35.json b/advisories/github-reviewed/2024/10/GHSA-x2fr-vj74-5h35/GHSA-x2fr-vj74-5h35.json new file mode 100644 index 00000000000..ac0cbea6d1d --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-x2fr-vj74-5h35/GHSA-x2fr-vj74-5h35.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x2fr-vj74-5h35", + "modified": "2024-10-25T21:46:55Z", + "published": "2024-10-25T21:31:27Z", + "aliases": [ + "CVE-2024-48223" + ], + "summary": "SQL injection in funadmin", + "details": "Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "funadmin/funadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48223" + }, + { + "type": "WEB", + "url": "https://github.com/funadmin/funadmin/issues/23" + }, + { + "type": "PACKAGE", + "url": "https://github.com/funadmin/funadmin" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-10-25T21:46:55Z", + "nvd_published_at": "2024-10-25T21:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-5g66-93qv-565j/GHSA-5g66-93qv-565j.json b/advisories/unreviewed/2024/10/GHSA-5g66-93qv-565j/GHSA-5g66-93qv-565j.json deleted file mode 100644 index 601dc448cfb..00000000000 --- a/advisories/unreviewed/2024/10/GHSA-5g66-93qv-565j/GHSA-5g66-93qv-565j.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-5g66-93qv-565j", - "modified": "2024-10-25T21:31:27Z", - "published": "2024-10-25T21:31:27Z", - "aliases": [ - "CVE-2024-48222" - ], - "details": "Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48222" - }, - { - "type": "WEB", - "url": "https://github.com/funadmin/funadmin/issues/22" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-10-25T21:15:03Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-6j8f-88mh-r9vq/GHSA-6j8f-88mh-r9vq.json b/advisories/unreviewed/2024/10/GHSA-6j8f-88mh-r9vq/GHSA-6j8f-88mh-r9vq.json deleted file mode 100644 index c460ac7a9cc..00000000000 --- a/advisories/unreviewed/2024/10/GHSA-6j8f-88mh-r9vq/GHSA-6j8f-88mh-r9vq.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-6j8f-88mh-r9vq", - "modified": "2024-10-25T21:31:27Z", - "published": "2024-10-25T21:31:27Z", - "aliases": [ - "CVE-2024-48224" - ], - "details": "Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48224" - }, - { - "type": "WEB", - "url": "https://github.com/funadmin/funadmin/issues/24" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-10-25T21:15:03Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-vw6x-c5rg-jmjp/GHSA-vw6x-c5rg-jmjp.json b/advisories/unreviewed/2024/10/GHSA-vw6x-c5rg-jmjp/GHSA-vw6x-c5rg-jmjp.json deleted file mode 100644 index 51fa0d9c511..00000000000 --- a/advisories/unreviewed/2024/10/GHSA-vw6x-c5rg-jmjp/GHSA-vw6x-c5rg-jmjp.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-vw6x-c5rg-jmjp", - "modified": "2024-10-25T21:31:27Z", - "published": "2024-10-25T21:31:27Z", - "aliases": [ - "CVE-2024-48225" - ], - "details": "Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48225" - }, - { - "type": "WEB", - "url": "https://github.com/funadmin/funadmin/issues/25" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-10-25T21:15:03Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-x2fr-vj74-5h35/GHSA-x2fr-vj74-5h35.json b/advisories/unreviewed/2024/10/GHSA-x2fr-vj74-5h35/GHSA-x2fr-vj74-5h35.json deleted file mode 100644 index de8b75c49b1..00000000000 --- a/advisories/unreviewed/2024/10/GHSA-x2fr-vj74-5h35/GHSA-x2fr-vj74-5h35.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-x2fr-vj74-5h35", - "modified": "2024-10-25T21:31:27Z", - "published": "2024-10-25T21:31:27Z", - "aliases": [ - "CVE-2024-48223" - ], - "details": "Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48223" - }, - { - "type": "WEB", - "url": "https://github.com/funadmin/funadmin/issues/23" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-10-25T21:15:03Z" - } -} \ No newline at end of file