netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-g5x8-v2ch-gj2g
GHSA-vprm-27pv-jp3w
GHSA-x7m9-mv49-fv73
GHSA-x7m9-mv49-fv73
This commit is contained in:
advisory-database[bot]
2025-01-09 23:14:41 +00:00
parent d34071517e
commit 27788066b5
4 changed files with 155 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/01/GHSA-g5x8-v2ch-gj2g/GHSA-g5x8-v2ch-gj2g.json → advisories/github-reviewed/2025/01/GHSA-g5x8-v2ch-gj2g/GHSA-g5x8-v2ch-gj2g.json
+39 -7
View File
@@ -1,19 +1,49 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g5x8-v2ch-gj2g",
"modified": "2025-01-09T21:31:32Z",
"modified": "2025-01-09T23:13:14Z",
"published": "2025-01-09T21:31:32Z",
"aliases": [
"CVE-2024-55224"
],
"summary": "Vaultwarden HTML injection vulnerability",
"details": "An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.",
"severity": [],
"affected": [],
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U"
}
],
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "vaultwarden"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.32.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55224"
},
{
"type": "PACKAGE",
"url": "https://github.com/dani-garcia/vaultwarden"
},
{
"type": "WEB",
"url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4"
@@ -28,10 +58,12 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2025-01-09T23:13:14Z",
"nvd_published_at": "2025-01-09T21:15:29Z"
}
}
advisories/unreviewed/2025/01/GHSA-vprm-27pv-jp3w/GHSA-vprm-27pv-jp3w.json → advisories/github-reviewed/2025/01/GHSA-vprm-27pv-jp3w/GHSA-vprm-27pv-jp3w.json
+39 -7
View File
@@ -1,19 +1,49 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vprm-27pv-jp3w",
"modified": "2025-01-09T21:31:32Z",
"modified": "2025-01-09T23:14:10Z",
"published": "2025-01-09T21:31:32Z",
"aliases": [
"CVE-2024-55226"
],
"summary": "Vaultwarden authenticated reflected cross-site scripting (XSS) vulnerability",
"details": "Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.",
"severity": [],
"affected": [],
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U"
}
],
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "vaultwarden"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.32.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55226"
},
{
"type": "PACKAGE",
"url": "https://github.com/dani-garcia/vaultwarden"
},
{
"type": "WEB",
"url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4"
@@ -28,10 +58,12 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2025-01-09T23:14:10Z",
"nvd_published_at": "2025-01-09T21:15:29Z"
}
}
advisories/github-reviewed/2025/01/GHSA-x7m9-mv49-fv73/GHSA-x7m9-mv49-fv73.json
+77
View File
@@ -0,0 +1,77 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x7m9-mv49-fv73",
"modified": "2025-01-09T23:13:58Z",
"published": "2025-01-09T21:31:32Z",
"aliases": [
"CVE-2024-55225"
],
"summary": "Vaultwarden vulnerable to user impersonation",
"details": "An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "vaultwarden"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.32.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55225"
},
{
"type": "WEB",
"url": "https://github.com/dani-garcia/vaultwarden/commit/20d9e885bfcd7df7828d92c6e59ed5fe7b40a879"
},
{
"type": "WEB",
"url": "https://github.com/dani-garcia/vaultwarden/commit/37c14c3c69b244ec50f5c62b4c9260171607c1d8"
},
{
"type": "PACKAGE",
"url": "https://github.com/dani-garcia/vaultwarden"
},
{
"type": "WEB",
"url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4"
},
{
"type": "WEB",
"url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5"
},
{
"type": "WEB",
"url": "https://insinuator.net/2024/11/vulnerability-disclosure-authentication-bypass-in-vaultwarden-versions-1-32-5"
}
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-01-09T23:13:58Z",
"nvd_published_at": "2025-01-09T21:15:29Z"
}
}
advisories/unreviewed/2025/01/GHSA-x7m9-mv49-fv73/GHSA-x7m9-mv49-fv73.json
-37
View File
@@ -1,37 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x7m9-mv49-fv73",
"modified": "2025-01-09T21:31:32Z",
"published": "2025-01-09T21:31:32Z",
"aliases": [
"CVE-2024-55225"
],
"details": "An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55225"
},
{
"type": "WEB",
"url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4"
},
{
"type": "WEB",
"url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5"
},
{
"type": "WEB",
"url": "https://insinuator.net/2024/11/vulnerability-disclosure-authentication-bypass-in-vaultwarden-versions-1-32-5"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T21:15:29Z"
}
}