Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-03 05:04:04 +00:00
parent 3fb096e006
commit 2963aa12be
884 changed files with 1604 additions and 4812 deletions
@@ -4,9 +4,7 @@
  "modified": "2023-06-30T22:10:59Z",
  "published": "2022-03-12T00:00:34Z",
  "withdrawn": "2023-06-30T22:10:59Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: Improper Authorization in Gogs",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-gw5h-h6hj-f56g. This link is maintained to preserve external references.\n\n## Original Description\n### Impact\n\nExpired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected.\n\n### Patches\n\nExpired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.\n\n### Workarounds\n\nIn addition to marking PAM accounts as expired, also disable/lock them. Running `usermod -L <username>` will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login. \n\n### References\n\nhttps://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6810.\n",
  "severity": [
@@ -70,9 +70,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-05T18:31:22Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "MoinMoin Cross-Site Scripting (XSS) vulnerability via hitcounts and general parameters",
  "details": "Multiple cross-site scripting (XSS) vulnerabilities in Info pages in MoinMoin 1.5.7 allow remote attackers to inject arbitrary web script or HTML via the (1) hitcounts and (2) general parameters, different vectors than CVE-2007-0857.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Apache Struts's ParameterInterceptor component does not prevent access to public constructors",
  "details": "The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -94,9 +92,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-27T20:24:03Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-8h83-chh2-fchp",
  "modified": "2022-11-10T23:58:32Z",
  "published": "2022-11-10T23:58:32Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "eZ Platform users with the Company admin role can assign any role to any user",
  "details": "Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.\n\nThe role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -51,9 +47,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-10T23:58:32Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-99r3-xmmq-7q7g",
  "modified": "2022-11-10T23:59:24Z",
  "published": "2022-11-10T23:59:24Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "eZ Platform users with the Company admin role can assign any role to any user",
  "details": "Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.\n\nThe role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -51,9 +47,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-10T23:59:24Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-pcpm-vc4v-cmvx",
  "modified": "2022-11-10T23:56:45Z",
  "published": "2022-11-10T23:56:45Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "eZ Platform users with the Company admin role can assign any role to any user",
  "details": "Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.\n\nThe role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -70,9 +66,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-10T23:56:45Z",
@@ -4,9 +4,7 @@
  "modified": "2023-04-03T17:18:44Z",
  "published": "2023-02-25T06:30:21Z",
  "withdrawn": "2023-04-03T17:18:44Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate advisory: Deno vulnerable to Regular Expression Denial of Service",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of [GHSA-jc97-h3h9-7xh6](https://github.com/advisories/GHSA-jc97-h3h9-7xh6). This link is maintained to preserve external references.\n\n## Original Description\nVersions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server. This issue has been patched in version 1.31.0.",
  "severity": [
@@ -77,9 +77,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-28T13:39:35Z",
@@ -53,9 +53,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-24T22:34:59Z",
@@ -4,9 +4,7 @@
  "modified": "2023-04-27T19:54:52Z",
  "published": "2023-04-25T18:30:23Z",
  "withdrawn": "2023-04-27T19:54:13Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: AVideo contains Command injection when embedding a video link",
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-pgvh-p3g4-86jw. This link is maintained to preserve external references.\n\n## Original Description\n\nImpact:\n\nAn attacker could execute remote code on a system running wwbn/avideo\n\nStep to Reproduce:\n\n1. Go to the `My Videos` tab\n\nhttps://demo.avideo.com/mvideos\n\n2. Click \"Embed a video link\"\n\nAppend a command to the url as a query string. eg. `?whoami`\n\n\nthen click Save\n\nThis issue has been resolved in commit `236228f15`",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-fwj4-72fm-c93g",
  "modified": "2023-05-05T02:18:26Z",
  "published": "2023-05-05T02:18:26Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Under-validated ComSpec and cmd.exe resolution in Mutagen projects",
  "details": "### Impact\n\nMutagen projects offer shell-based execution functionality.  On Windows, the shell is resolved using the standard `%ComSpec%` mechanism, with a fallback to a `%PATH%`-based search for `cmd.exe`.  While this is the standard practice on Windows systems, it presents somewhat risky behavior.\n\nFirstly, `%ComSpec%` could, in theory, be set maliciously.  Unfortunately, there's not much that can be done to prevent this attack surface, because `%ComSpec%` is the official mechanism for shell specification on Windows.  We can, however, validate that it points to an absolute path, which one would expect for a properly set value.\n\nSecondly, a fallback to a relative `cmd.exe` path, resolved via `%PATH%`, could be risky.  The risk is largely mitigated by changes in Go 1.19 and later, but prior to that a malicious `cmd.exe` could been resolved in the current working directory.  To mitigate this issue, Mutagen now uses the `%SystemRoot%` environment variable (also validated to be an absolute path) to resolve `cmd.exe` in the event that `%ComSpec%` is not set correctly.\n\n\n### Patches\n\nThe problem has been patched in Mutagen v0.16.6 and v0.17.1. Earlier versions of Mutagen are no longer supported and will not be patched. Versions of Mutagen after v0.18.0 will also have the patch merged.\n\n\n### Workarounds\n\nMaintain control of the environment variable settings on your system, in particular the `ComSpec` environment variable.\n\n### References\n\nMore information on `%ComSpec%` can be found [online](https://en.wikipedia.org/wiki/COMSPEC).\n\nMore information on Go's `PATH`-based lookup changes can be found [here](https://go.dev/blog/path-security), [here](https://go.dev/doc/go1.19#os-exec-path), and [here](https://github.com/golang/go/issues/43947).\n\nA [similar issue](https://github.com/python/cpython/issues/101283) that was addressed within the Python subprocess module also provides additional discussion.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -62,9 +58,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-05T02:18:26Z",
@@ -214,9 +214,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-19T20:27:27Z",
@@ -58,9 +58,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-09T14:40:15Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-f8pq-3926-8gx5",
  "modified": "2023-08-09T20:59:14Z",
  "published": "2023-08-09T20:59:14Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Unsanitized user controlled input in module generation",
  "details": "## Impact\n\nThe `import-in-the-middle` loader used by `@opentelemetry/instrumentation` works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. It allows for remote code execution in cases where an application passes user-supplied input directly to an `import()` function.\n\n## Patches\n\nThis vulnerability has been patched in `@opentelemetry/instrumentation` version `0.41.2`\n\n## Workarounds\n\n- Do not pass any user-supplied input to `import()`. Instead, verify it against a set of allowed values.\n- If using `@opentelemetry/instrumentation` with support for EcmaScript Modules is not needed, ensure that none of the following options are set (either via command-line or the `NODE_OPTIONS` environment variable):\n```\n--experimental-loader=@opentelemetry/instrumentation/hook.mjs\n--experimental-loader @opentelemetry/instrumentation/hook.mjs\n--loader=import-in-the-middle/hook.mjs\n--loader import-in-the-middle/hook.mjs\n```\n\n## References\n\n- https://github.com/DataDog/import-in-the-middle/security/advisories/GHSA-5r27-rw8r-7967",
  "severity": [
@@ -50,9 +48,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-09T20:59:14Z",
@@ -54,9 +54,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-04T17:27:09Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-6878-6wc2-pf5h",
  "modified": "2023-10-24T19:22:26Z",
  "published": "2023-10-24T19:22:26Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Sequential calls of encryption API (`encrypt`, `wrap`, and `dump`) result in nonce reuse",
  "details": "**Problem**: Trying to create a new encrypted message with the same cocoon object generates the same ciphertext. It mostly affects `MiniCocoon` and `Cocoon` objects with custom seeds and RNGs (where `StdRng` is used under the hood).\n\n**Note**: The issue does **NOT** affect objects created with **`Cocoon::new`** which utilizes `ThreadRng`.\n\n**Cause**: `StdRng` produces the same nonce because `StdRng::clone` resets its state.\n\n**Measure**: Make encryption API mutable (`encrypt`, `wrap`, and `dump`).\n\n**Workaround**: Create a new cocoon object with a new **seed** per each encryption.\n\n## How to Reproduce\n\n```rust\nlet cocoon = MiniCocoon::from_password(b\"password\", &[1; 32]);\nlet mut data1 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(&mut data1)?;\n\nlet mut data2 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(&mut data2)?;\n\n// data1: [23, 217, 251, 151, 179, 62, 85, 15, 253, 92, 192, 112, 200, 52]\n// data2: [23, 217, 251, 151, 179, 62, 85, 15, 253, 92, 192, 112, 200, 52]\n```\n\n## Workaround\n\nFor `cocoon <= 0.3.3`, create a new cocoon with a different **seed** per each `encrypt`/`wrap`/`dump` call.\n\n```rust\nlet cocoon = MiniCocoon::from_password(b\"password\", &[1; 32]);\nlet mut data1 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(&mut data1)?;\n\n// Another seed: &[2; 32].\nlet cocoon = MiniCocoon::from_password(b\"password\", &[2; 32]);\nlet mut data2 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(&mut data2)?;\n\n// data1: [23, 217, 251, 151, 179, 62, 85, 15, 253, 92, 192, 112, 200, 52]\n// data2: [53, 223, 209, 96, 130, 99, 209, 108, 83, 189, 123, 81, 19, 1]\n```",
  "severity": [
@@ -64,9 +62,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-24T19:22:26Z",
@@ -77,9 +77,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-13T19:27:34Z",
--- a/Show More
+++ b/Show More