netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-hpj2-4hfj-g233
GHSA-j9wr-mj69-cqmv
GHSA-p29c-jpgj-v57r
GHSA-hpj2-4hfj-g233
This commit is contained in:
advisory-database[bot]
2024-04-25 21:21:53 +00:00
parent 4e0841719e
commit 2c1988578f
4 changed files with 131 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-hpj2-4hfj-g233/GHSA-hpj2-4hfj-g233.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hpj2-4hfj-g233",
"modified": "2024-04-25T21:20:27Z",
"published": "2022-05-24T17:10:47Z",
"aliases": [
"CVE-2020-5203"
],
"summary": "Fat-Free Framework arbitrary code execution",
"details": "In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., `$_REQUEST`, `$_GET`, or `$_POST`) to the framework's Clear method.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "bcosca/fatfree"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5203"
},
{
"type": "WEB",
"url": "https://github.com/bcosca/fatfree-core/commit/dae95a0baf3963a9ef87c17cee52f78f77e21829"
},
{
"type": "PACKAGE",
"url": "https://github.com/bcosca/fatfree"
},
{
"type": "WEB",
"url": "https://github.com/bcosca/fatfree/releases"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:20:27Z",
"nvd_published_at": "2020-03-11T14:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-j9wr-mj69-cqmv/GHSA-j9wr-mj69-cqmv.json → advisories/github-reviewed/2022/05/GHSA-j9wr-mj69-cqmv/GHSA-j9wr-mj69-cqmv.json
+32 -6
View File
@@ -1,17 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j9wr-mj69-cqmv",
"modified": "2022-05-24T17:10:26Z",
"modified": "2024-04-25T21:21:27Z",
"published": "2022-05-24T17:10:26Z",
"aliases": [
"CVE-2020-10237"
],
"summary": "Froxlor Exposure of Sensitive Information to an Unauthorized Actor",
"details": "An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "froxlor/froxlor"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.10.15"
}
]
}
]
}
],
"references": [
{
@@ -21,15 +43,19 @@
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1165719"
},
{
"type": "PACKAGE",
"url": "https://github.com/Froxlor/Froxlor"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:21:27Z",
"nvd_published_at": "2020-03-09T16:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-p29c-jpgj-v57r/GHSA-p29c-jpgj-v57r.json → advisories/github-reviewed/2022/05/GHSA-p29c-jpgj-v57r/GHSA-p29c-jpgj-v57r.json
+34 -7
View File
@@ -1,17 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p29c-jpgj-v57r",
"modified": "2022-05-24T17:10:26Z",
"modified": "2024-04-25T21:21:25Z",
"published": "2022-05-24T17:10:26Z",
"aliases": [
"CVE-2020-10235"
],
"summary": "Froxlor arbitrary code execution via the database configuration options",
"details": "An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "froxlor/froxlor"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.14"
}
]
}
]
}
],
"references": [
{
@@ -30,6 +52,10 @@
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1165721"
},
{
"type": "PACKAGE",
"url": "https://github.com/Froxlor/Froxlor"
},
{
"type": "WEB",
"url": "https://github.com/Froxlor/Froxlor/compare/0.10.13...0.10.14"
@@ -37,11 +63,12 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-78"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:21:25Z",
"nvd_published_at": "2020-03-09T16:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-hpj2-4hfj-g233/GHSA-hpj2-4hfj-g233.json
-39
View File
@@ -1,39 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hpj2-4hfj-g233",
"modified": "2022-05-24T17:10:47Z",
"published": "2022-05-24T17:10:47Z",
"aliases": [
"CVE-2020-5203"
],
"details": "In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the framework's Clear method.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5203"
},
{
"type": "WEB",
"url": "https://github.com/bcosca/fatfree-core/commit/dae95a0baf3963a9ef87c17cee52f78f77e21829"
},
{
"type": "WEB",
"url": "https://github.com/bcosca/fatfree/releases"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-03-11T14:15:00Z"
}
}