netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-43h9-p3j4-39hm
GHSA-vvpf-53qx-cxhh
GHSA-43mq-6xmg-29vm
GHSA-pqj8-xhcx-prxm
GHSA-v778-237x-gjrc
GHSA-43h9-p3j4-39hm
GHSA-vvpf-53qx-cxhh
This commit is contained in:
advisory-database[bot]
2024-12-11 22:03:38 +00:00
parent 14cf939769
commit 292bb4da0f
7 changed files with 404 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/02/GHSA-43h9-p3j4-39hm/GHSA-43h9-p3j4-39hm.json
+137
View File
@@ -0,0 +1,137 @@
{
"schema_version": "1.4.0",
"id": "GHSA-43h9-p3j4-39hm",
"modified": "2024-12-11T22:02:12Z",
"published": "2024-02-20T12:31:00Z",
"aliases": [
"CVE-2024-25607"
],
"summary": "Liferay Portal defaults to a low work factor for the default password hashing algorithm",
"details": "The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.3.0"
},
{
"fixed": "7.3.10.u4"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.2.10.fp17"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.4.0"
},
{
"fixed": "7.4.13.u16"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.portal.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.3.14"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:com.liferay.portal.kernel"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "38.0.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25607"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25607"
}
],
"database_specific": {
"cwe_ids": [
"CWE-916"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-12-11T22:02:12Z",
"nvd_published_at": "2024-02-20T10:15:08Z"
}
}
advisories/github-reviewed/2024/02/GHSA-vvpf-53qx-cxhh/GHSA-vvpf-53qx-cxhh.json
+137
View File
@@ -0,0 +1,137 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vvpf-53qx-cxhh",
"modified": "2024-12-11T22:02:18Z",
"published": "2024-02-20T15:31:03Z",
"aliases": [
"CVE-2024-25610"
],
"summary": "Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)",
"details": "In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s content text field.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.portal.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.3.13"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.4.0"
},
{
"fixed": "7.4.13.u9"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.3.0"
},
{
"fixed": "7.3.10.u4"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.2.10.fp19"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:com.liferay.portal.web"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.96"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25610"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25610"
}
],
"database_specific": {
"cwe_ids": [
"CWE-1188"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-12-11T22:02:18Z",
"nvd_published_at": "2024-02-20T13:15:08Z"
}
}
advisories/unreviewed/2024/12/GHSA-43mq-6xmg-29vm/GHSA-43mq-6xmg-29vm.json → advisories/github-reviewed/2024/12/GHSA-43mq-6xmg-29vm/GHSA-43mq-6xmg-29vm.json
+33 -6
View File
@@ -1,19 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-43mq-6xmg-29vm",
"modified": "2024-12-11T18:30:42Z",
"modified": "2024-12-11T22:02:54Z",
"published": "2024-12-11T18:30:42Z",
"aliases": [
"CVE-2024-53677"
],
"summary": "Apache Struts file upload logic is flawed",
"details": "File upload logic is flawed vulnerability in Apache Struts.\n\nThis issue affects Apache Struts: from 2.0.0 before 6.4.0.\n\nUsers are recommended to upgrade to version 6.4.0, which fixes the issue.\n\nYou can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:L/U:Red"
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.struts:struts2-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.0"
}
]
}
]
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -22,13 +43,19 @@
{
"type": "WEB",
"url": "https://cwiki.apache.org/confluence/display/WW/S2-067"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/struts"
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-22"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-12-11T22:02:54Z",
"nvd_published_at": "2024-12-11T16:15:14Z"
}
}
advisories/unreviewed/2024/12/GHSA-pqj8-xhcx-prxm/GHSA-pqj8-xhcx-prxm.json → advisories/github-reviewed/2024/12/GHSA-pqj8-xhcx-prxm/GHSA-pqj8-xhcx-prxm.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pqj8-xhcx-prxm",
"modified": "2024-12-11T18:30:40Z",
"modified": "2024-12-11T22:02:35Z",
"published": "2024-12-04T18:32:36Z",
"aliases": [
"CVE-2024-39163"
],
"summary": "pyspider Cross-Site Request Forgery (CSRF) via the Flask endpoints",
"details": "binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Flask endpoints.",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pyspider"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.3.10"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39163"
},
{
"type": "PACKAGE",
"url": "https://github.com/binux/pyspider"
},
{
"type": "WEB",
"url": "https://github.com/binux/pyspider/blob/master/pyspider/webui/debug.py#L39"
@@ -33,8 +58,8 @@
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-12-11T22:02:35Z",
"nvd_published_at": "2024-12-04T17:15:13Z"
}
}
advisories/github-reviewed/2024/12/GHSA-v778-237x-gjrc/GHSA-v778-237x-gjrc.json
+68
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2024/02/GHSA-43h9-p3j4-39hm/GHSA-43h9-p3j4-39hm.json
-36
View File
@@ -1,36 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-43h9-p3j4-39hm",
"modified": "2024-02-20T12:31:00Z",
"published": "2024-02-20T12:31:00Z",
"aliases": [
"CVE-2024-25607"
],
"details": "The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25607"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25607"
}
],
"database_specific": {
"cwe_ids": [
"CWE-916"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-20T10:15:08Z"
}
}
advisories/unreviewed/2024/02/GHSA-vvpf-53qx-cxhh/GHSA-vvpf-53qx-cxhh.json
-36
View File
@@ -1,36 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vvpf-53qx-cxhh",
"modified": "2024-12-11T18:30:35Z",
"published": "2024-02-20T15:31:03Z",
"aliases": [
"CVE-2024-25610"
],
"details": "In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s content text field.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25610"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25610"
}
],
"database_specific": {
"cwe_ids": [
"CWE-1188"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-20T13:15:08Z"
}
}