Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-02 05:18:44 +00:00
parent 43c3bb1281
commit 27a793b6ee
817 changed files with 1557 additions and 4671 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "Denial of Service in ecstatic",
  "details": "Versions of `ecstatic` prior to 1.4.0 are affected by a denial of service vulnerability when certain input strings are sent via the `Last-Modified` or `If-Modified-Since` headers.\n\nParsing certain inputs with `new Date()` or `Date.parse()` cases v8 to crash. As ecstatic passes the value of the affected headers into one of these functions, sending certain inputs via one of the headers will cause the server to crash.\n\n\n\n## Recommendation\n\nUpdate to version 1.4.0 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Insecure Comparison in secure-compare",
  "details": "Versions of `secure-compare` prior to 3.0.1 are affected by a vulnerability that results in the package always returning true when comparing two strings of the same length, despite differences in the contents of those strings.\n\n\n## Recommendation\n\nUpgrade to version 3.0.1 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-fr26-qjc8-mvjx",
  "modified": "2021-10-13T17:45:05Z",
  "published": "2021-10-13T18:56:12Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19",
  "details": "Improper sanitization of path in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for `NotFoundException` is provided.",
  "severity": [
@@ -84,9 +82,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-13T17:45:05Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-jfmf-w293-8xr8",
  "modified": "2021-10-13T17:43:34Z",
  "published": "2021-10-13T18:55:52Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8",
  "details": "Unsafe validation RegEx in `EmailValidator` component in `com.vaadin:vaadin-compatibility-server` versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.",
  "severity": [
@@ -53,9 +51,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-13T17:43:34Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Cross Site Scripting in Microweber",
  "details": "Cross Site Scripting (XSS). vulnerability exists in Microweber CMS 1.2.7 via the Login form, which could let a malicious user execute Javascript by Inserting code in the request form.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -9,9 +9,7 @@
  ],
  "summary": "Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.",
  "details": "# Withdrawn\n\nThis advisory has been withdrawn after the maintainers of Laravel noted this issue is not a security vulnerability with Laravel itself, but rather a userland issue.\n\n## Original CVE based description\n\nLaravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. In some use cases, this may be related to file-type validation for image upload (e.g., differences between getClientOriginalExtension and other approaches).",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-5629-8855-gf4g",
  "modified": "2021-11-17T21:07:30Z",
  "published": "2021-11-18T20:12:40Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Authentication Bypass by CSRF Weakness ",
  "details": "### Impact\nThe actual vulnerability has been discovered on `solidus_auth_devise`. See [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2) for details.\n\nThe security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update `solidus_auth_devise`. For this reason, it has been marked as low impact on this end.\n\n### Patches\nFor extra security, update `solidus_core` to versions `3.1.3`, `3.0.3` or `2.11.12`.\n\n### Workarounds\nLook at the workarounds described at [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).\n\n### References\n- [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [solidus_auth_devise](https://github.com/solidusio/solidus_auth_devise/issues) or a discussion in [solidus](https://github.com/solidusio/solidus/discussions)\n* Email us at [security@solidus.io](mailto:security@soliidus.io)\n* Contact the core team on [Slack](http://slack.solidus.io/)\n",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-77vh-xpmg-72qh",
  "modified": "2021-11-24T19:43:35Z",
  "published": "2021-11-18T16:02:41Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Clarify `mediaType` handling",
  "details": "### Impact\nIn the OCI Image Specification version 1.0.1 and prior, manifest and index documents are not self-describing and documents with a single digest could be interpreted as either a manifest or an index.\n\n### Patches\nThe Image Specification will be updated to recommend that both manifest and index documents contain a `mediaType` field to identify the type of document.\nRelease [v1.0.2](https://github.com/opencontainers/image-spec/releases/tag/v1.0.2) includes these updates.\n\n### Workarounds\nSoftware attempting to deserialize an ambiguous document may reject the document if it contains both “manifests” and “layers” fields or “manifests” and “config” fields.\n\n### References\nhttps://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/opencontainers/image-spec\n* Email us at [security@opencontainers.org](mailto:security@opencontainers.org)\n* https://github.com/opencontainers/image-spec/commits/v1.0.2\n",
  "severity": [
@@ -8,9 +8,7 @@
  ],
  "summary": "Server-Side Request Forgery in Concrete CMS",
  "details": "Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable to SSRF attacks on the private LAN to servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-jcjx-c3j3-44pr",
  "modified": "2021-11-08T21:09:02Z",
  "published": "2021-11-10T16:44:12Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Insufficient Session Expiration in @cyyynthia/tokenize",
  "details": "### Impact\nA bug introduced in version 1.1.0 made Tokenize generate faulty tokens with NaN as a generation date. As a result, tokens would not properly expire and remain valid regardless of the `lastTokenReset` field.\n\n### Patches\nVersion 1.1.3 contains a patch that'll invalidate these faulty tokens and make new ones behave as expected.\n\n### Workarounds\nNone. Tokens do not hold the necessary information to perform invalidation anymore.\n\n### References\nPR #1\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [github.com/cyyynthia/tokenize](https://github.com/cyyynthia/tokenize)\n* Email us at [cynthia@cynthia.dev](mailto:cynthia@cynthia.dev)\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Exposure of sensitive information in concrete5/core",
  "details": "In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in \"add / edit message”.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Server-Side Request Forgery in Concrete CMS",
  "details": "Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS (ex AWS) IAM keys.To fix this Concrete CMS no longer allows downloads from the local network and specifies the validated IP when downloading rather than relying on DNS.Discoverer.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Password exposure in concrete5/core",
  "details": "Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations were put in place a. restricting file types for view_inline to images only b. putting a warning in the file manager to advise users.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-v935-pqmr-g8v9",
  "modified": "2021-11-03T15:02:32Z",
  "published": "2021-11-03T17:36:04Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Unexpected panics in num-bigint",
  "details": "### Impact\n\nTwo scenarios were reported where `BigInt` and `BigUint` multiplication may unexpectedly panic.\n\n- The internal `mac3` function did not expect the possibility of non-empty all-zero inputs, leading to an `unwrap()` panic.\n- A buffer was allocated with less capacity than needed for an intermediate result, leading to an assertion panic.\n\nRust panics can either cause stack unwinding or program abort, depending on the application configuration. In some settings, an unexpected panic may constitute a denial-of-service vulnerability.\n\n### Patches\nBoth problems were introduced in version 0.4.1, and are fixed in version 0.4.3.\n\n### For more information\nIf you have any questions or comments about this advisory, please open an issue in the [num-bigint](https://github.com/rust-num/num-bigint) repo.\n\n### Acknowledgements\nThanks to Guido Vranken and Arvid Norberg for privately reporting these issues to the author.\n\n### References\n* [GHSA-v935-pqmr-g8v9](https://github.com/rust-num/num-bigint/security/advisories/GHSA-v935-pqmr-g8v9)\n* [num-bigint#228](https://github.com/rust-num/num-bigint/pull/228)\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-wmpv-c2jp-j2xg",
  "modified": "2021-11-15T22:27:38Z",
  "published": "2021-11-15T23:28:18Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "ERC1155Supply vulnerability in OpenZeppelin Contracts",
  "details": "When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the `ERC1155Supply` extension, total supply is not updated until after the callback, thus during the callback the reported total supply is lower than the real number of tokens in circulation.\n\n### Impact\nIf a system relies on accurately reported supply, an attacker may be able to mint tokens and invoke that system after receiving the token balance but before the supply is updated.\n\n### Patches\nA fix is included in version 4.3.3 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.\n\n### Workarounds\nIf accurate supply is relevant, do not mint tokens to untrusted receivers.\n\n### Credits\nThe issue was identified and reported by @ChainSecurityAudits.\n\n### For more information\nRead [TotalSupply Inconsistency in ERC1155 NFT Tokens](https://medium.com/chainsecurity/totalsupply-inconsistency-in-erc1155-nft-tokens-8f8e3b29f5aa) by @ChainSecurityAudits for a more detailed breakdown.\n\nIf you have any questions or comments about this advisory, email us at security@openzeppelin.com.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -62,9 +58,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-15T22:27:38Z",
@@ -9,9 +9,7 @@
  ],
  "summary": "OS Command injection in docker-cli-js",
  "details": "# Withdrawn\n\nAfter reviewing this CVE, and [this response from the maintainer](https://github.com/Quobject/docker-cli-js/issues/22#issuecomment-967760940), we have withdrawn this advisory.\n\n# Original CVE description\n\nThis affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will be in a position to execute any arbitrary OS commands on the host system. ",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-446q-xxg5-3vhh",
  "modified": "2022-11-10T23:57:04Z",
  "published": "2022-11-10T23:57:04Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "eZ Platform users with the Company admin role can assign any role to any user",
  "details": "Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.\n\nThe role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -51,9 +47,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-10T23:57:04Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-5wvv-q5fv-2388",
  "modified": "2022-12-30T16:57:28Z",
  "published": "2022-12-30T16:57:28Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "hyper-staticfile's location header incorporates user input, allowing open redirect",
  "details": "When `hyper-staticfile` performs a redirect for a directory request (e.g. a request for `/dir` that redirects to `/dir/`), the `Location` header value was derived from user input (the request path), simply appending a slash. The intent was to perform an origin-relative redirect, but specific inputs allowed performing a scheme-relative redirect instead.\n\nAn attacker could craft a special URL that would appear to be for the correct domain, but immediately redirects to a malicious domain. Such a URL can benefit phishing attacks, for example an innocent looking link in an email.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-gfgm-chr3-x6px",
  "modified": "2022-12-30T17:48:30Z",
  "published": "2022-12-30T17:48:30Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "prettytable-rs: Force cast a &Vec<T> to &[T] may lead to undefined behavior",
  "details": "In function `Table::as_ref`, a reference of vector is force cast to slice. There are multiple problems here:\n1. To guarantee the size is correct, we have to first do `Vec::shrink_to_fit`. The function requires a mutable reference, so we have to force cast from immutable to mutable, which is undefined behavior (UB).\n2. Even if (1) is sound, `&Vec<T>` and `&[T]` still might not have the same layout. Treating them equally may lead to undefinted behavior (UB).\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -47,9 +43,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-30T17:48:30Z",
--- a/Show More
+++ b/Show More