Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-02 05:14:57 +00:00
parent 128b507569
commit 262c53145c
899 changed files with 1746 additions and 5238 deletions
@@ -3,14 +3,10 @@
  "id": "GHSA-2frx-j9hj-6c65",
  "modified": "2021-10-08T21:21:39Z",
  "published": "2021-05-17T20:52:21Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "User enumeration in authentication mechanisms",
  "details": "Description\n-----------\n\nThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. \n\nResolution\n----------\n\nWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist.\n\nThe patch for this issue is available [here](https://github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7) for branch 2.10.x and 2.x.\n\nCredits\n-------\n\nI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-7h5v-85w9-pq6c",
  "modified": "2021-05-19T19:34:56Z",
  "published": "2021-05-19T23:01:45Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Denial of service (via resource exhaustion) due to improper input validation in third-party identifier endpoint",
  "details": "### Impact\nMissing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion.\n\n### Patches\nThe issue is fixed by https://github.com/matrix-org/synapse/pull/9855.\n\n### Workarounds\nThere are no known workarounds.\n\n### References\nn/a\n\n### For more information\nIf you have any questions or comments about this advisory, email us at security@matrix.org.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-8796-gc9j-63rv",
  "modified": "2021-10-05T16:31:48Z",
  "published": "2021-05-17T20:51:16Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "File upload local preview can run embedded scripts after user interaction",
  "details": "### Impact\n\nWhen uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file, but only after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users.\n\n### Patches\n\nThis has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5981, which is included in 3.21.0.\n\n### Workarounds\n\nThere are no known workarounds.",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-9vxv-wpv4-f52p",
  "modified": "2021-05-18T16:06:57Z",
  "published": "2021-05-21T14:29:33Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Information leakage in Error Handler",
  "details": "### Impact\nInformation leakage in Error Handler\n\n### Patches\nWe recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.\n\nFor older versions you can use the Security Plugin:\nhttps://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html\n\n\n### References\nhttps://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-f6p7-8xfw-fjqq",
  "modified": "2021-05-18T16:08:07Z",
  "published": "2021-05-21T14:29:26Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Authenticated Stored XSS in Administration",
  "details": "### Impact\nAuthenticated Stored XSS in Administration\n\n### Patches\nWe recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.\n\nFor older versions you can use the Security Plugin:\nhttps://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html\n\n\n### References\nhttps://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-g2qj-pmxm-9f8f",
  "modified": "2021-10-08T21:21:12Z",
  "published": "2021-05-17T20:52:32Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "User enumeration in authentication mechanisms",
  "details": "Description\n-----------\n\nThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user.\n\nResolution\n----------\n\nWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011) for branch 3.4.\n\nCredits\n-------\n\nI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Incorrect Authorization in Spring Cloud Netflix Zuul",
  "details": "Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security's StrictHttpFirewall (enabled by default for all URLs) are not affected by the vulnerability, as they reject requests that allow bypassing.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Cryptographically weak CSRF tokens in Apache MyFaces",
  "details": "In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.\n\n\nMitigation:\nExisting web.xml configuration parameters can be used to direct\nMyFaces to use SecureRandom for CSRF token generation:\n\norg.apache.myfaces.RANDOM_KEY_IN_VIEW_STATE_SESSION_TOKEN=secureRandom\norg.apache.myfaces.RANDOM_KEY_IN_CSRF_SESSION_TOKEN=secureRandom\norg.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN=secureRandom",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -4,9 +4,7 @@
  "modified": "2021-12-14T18:14:54Z",
  "published": "2021-12-14T18:14:04Z",
  "withdrawn": "2021-05-27T19:07:52Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Open Redirect in Flask-Security-Too",
  "details": "# Withdrawn\n\nDuplicate of GHSA-6qmf-fj6m-686c\n\n# Original description\n\nFlask-Security-Too allows redirects after many successful views (e.g. /login) by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting URL.\n\nThis check utilizes Pythons urlsplit library. However many browsers are very lenient on the kind of URL they accept and 'fill in the blanks' when presented with a possibly incomplete URL. As a concrete example - setting http://login?next=\\\\\\github.com\nwill pass FS's relative URL check however many browsers will gladly convert this to http://github.com. Thus an attacker could send such a link to an unwitting user, using a legitimate site and have it redirect to whatever site they want.\n\nThis is considered a low severity due to the fact that if Werkzeug is used (which is very common with Flask applications) as the WSGI layer, it by default ALWAYS ensures that the Location header is absolute - thus making this attack vector mute. It is possible for application writers to modify this default behavior by setting the 'autocorrect_location_header=False`.",
  "severity": [
@@ -8,9 +8,7 @@
  ],
  "summary": "Cross-site Scripting in aurelia-framework",
  "details": "The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via (for example) JavaScript code in an attribute of various other elements. An attacker might also exploit a bug in how the SCRIPT string is processed by splitting and nesting them for example.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -62,9 +62,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-15T15:25:20Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Moodle cross-site request forgery (CSRF) vulnerability",
  "details": "Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -125,9 +125,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-25T21:19:55Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Drupal Access Control Bypass",
  "details": "Drupal 7.x before 7.3 allows remote attackers to bypass intended `node_access` restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Roundup Improper Access Control",
  "details": "The EditCSVAction function in `cgi/actions.py` in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -105,9 +103,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-01T19:31:05Z",
@@ -75,9 +75,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-07T18:11:18Z",
@@ -4,9 +4,7 @@
  "modified": "2023-11-10T22:06:44Z",
  "published": "2022-12-13T21:30:26Z",
  "withdrawn": "2022-12-14T21:32:34Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: .NET Framework Remote Code Execution Vulnerability.",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-2c7v-qcjp-4mg2. This link is maintained to preserve external references.\n\n## Original Description\n.NET Framework Remote Code Execution Vulnerability.",
  "severity": [
@@ -50,9 +48,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-14T21:32:34Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-4xgv-j62q-h3rj",
  "modified": "2023-06-13T23:50:39Z",
  "published": "2023-02-07T18:36:47Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2",
  "details": "### Impact\n\nDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash.\n\nThis issue could be abused to cause a denial of service.\n\n### Workaround\n\nNone, upgrade to 2.2.4\n",
  "severity": [
@@ -73,9 +71,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-07T18:36:47Z",
@@ -14,9 +14,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -14,9 +14,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
--- a/Show More
+++ b/Show More