netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-6wm9-966m-73jr
GHSA-c8mx-43cq-993w
GHSA-hx79-x87c-hgm3
GHSA-r6qq-qc9m-98w2
GHSA-rwh8-h525-4jvj
GHSA-vrpv-26fm-7vf7
GHSA-hx79-x87c-hgm3
GHSA-vrpv-26fm-7vf7
This commit is contained in:
advisory-database[bot]
2024-04-25 20:40:49 +00:00
parent 72a82ccf31
commit 2d85d40747
8 changed files with 309 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-6wm9-966m-73jr/GHSA-6wm9-966m-73jr.json → advisories/github-reviewed/2022/05/GHSA-6wm9-966m-73jr/GHSA-6wm9-966m-73jr.json
+31 -5
View File
@@ -1,23 +1,49 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6wm9-966m-73jr",
"modified": "2022-05-24T17:35:20Z",
"modified": "2024-04-25T20:39:34Z",
"published": "2022-05-24T17:35:20Z",
"aliases": [
"CVE-2020-5680"
],
"summary": "EC-CUBE Improper input validation vulnerability",
"details": "Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.5"
},
{
"last_affected": "3.0.18"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5680"
},
{
"type": "PACKAGE",
"url": "https://github.com/EC-CUBE/ec-cube"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN24457594/index.html"
@@ -32,8 +58,8 @@
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T20:39:34Z",
"nvd_published_at": "2020-12-03T12:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-c8mx-43cq-993w/GHSA-c8mx-43cq-993w.json → advisories/github-reviewed/2022/05/GHSA-c8mx-43cq-993w/GHSA-c8mx-43cq-993w.json
+31 -5
View File
@@ -1,23 +1,49 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c8mx-43cq-993w",
"modified": "2022-05-24T19:01:56Z",
"modified": "2024-04-25T20:40:12Z",
"published": "2022-05-24T19:01:56Z",
"aliases": [
"CVE-2021-20717"
],
"summary": "EC-CUBE Cross-site scripting vulnerability",
"details": "Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"last_affected": "4.0.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20717"
},
{
"type": "PACKAGE",
"url": "https://github.com/EC-CUBE/ec-cube"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN97554111/index.html"
@@ -36,8 +62,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T20:40:12Z",
"nvd_published_at": "2021-05-10T10:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-hx79-x87c-hgm3/GHSA-hx79-x87c-hgm3.json
+91
View File
@@ -0,0 +1,91 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hx79-x87c-hgm3",
"modified": "2024-04-25T20:39:27Z",
"published": "2022-05-24T17:21:18Z",
"aliases": [
"CVE-2020-5590"
],
"summary": "EC-CUBE Directory traversal vulnerability",
"details": "Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.18"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.4"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 4.0.3"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5590"
},
{
"type": "PACKAGE",
"url": "https://github.com/EC-CUBE/ec-cube"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN77458946/index.html"
},
{
"type": "WEB",
"url": "https://www.ec-cube.net/info/weakness/weakness.php?id=73"
},
{
"type": "WEB",
"url": "https://www.ec-cube.net/info/weakness/weakness.php?id=74"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T20:39:27Z",
"nvd_published_at": "2020-06-19T10:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-r6qq-qc9m-98w2/GHSA-r6qq-qc9m-98w2.json → advisories/github-reviewed/2022/05/GHSA-r6qq-qc9m-98w2/GHSA-r6qq-qc9m-98w2.json
+34 -5
View File
@@ -1,23 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r6qq-qc9m-98w2",
"modified": "2022-05-24T19:06:28Z",
"modified": "2024-04-25T20:40:20Z",
"published": "2022-05-24T19:06:28Z",
"aliases": [
"CVE-2021-20751"
],
"summary": "EC-CUBE Cross-site scripting vulnerability",
"details": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.6"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 4.0.5-p1"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20751"
},
{
"type": "PACKAGE",
"url": "https://github.com/EC-CUBE/ec-cube"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN95292458/index.html"
@@ -32,8 +61,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T20:40:20Z",
"nvd_published_at": "2021-06-28T01:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-rwh8-h525-4jvj/GHSA-rwh8-h525-4jvj.json → advisories/github-reviewed/2022/05/GHSA-rwh8-h525-4jvj/GHSA-rwh8-h525-4jvj.json
+31 -5
View File
@@ -1,23 +1,49 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rwh8-h525-4jvj",
"modified": "2022-05-24T17:35:20Z",
"modified": "2024-04-25T20:39:31Z",
"published": "2022-05-24T17:35:20Z",
"aliases": [
"CVE-2020-5679"
],
"summary": "EC-CUBE Improper Restriction of Rendered UI Layers or Frames",
"details": "Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.18"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5679"
},
{
"type": "PACKAGE",
"url": "https://github.com/EC-CUBE/ec-cube"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN24457594/index.html"
@@ -32,8 +58,8 @@
"CWE-1021"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T20:39:31Z",
"nvd_published_at": "2020-12-03T12:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-vrpv-26fm-7vf7/GHSA-vrpv-26fm-7vf7.json
+91
View File
@@ -0,0 +1,91 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vrpv-26fm-7vf7",
"modified": "2024-04-25T20:40:16Z",
"published": "2022-05-24T19:06:27Z",
"aliases": [
"CVE-2021-20750"
],
"summary": "EC-CUBE Cross-site scripting vulnerability",
"details": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.18-p2"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.6"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 4.0.5-p1"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20750"
},
{
"type": "PACKAGE",
"url": "https://github.com/EC-CUBE/ec-cube"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN95292458/index.html"
},
{
"type": "WEB",
"url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
},
{
"type": "WEB",
"url": "https://www.ec-cube.net/info/weakness/weakness.php?id=79"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T20:40:16Z",
"nvd_published_at": "2021-06-28T01:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-hx79-x87c-hgm3/GHSA-hx79-x87c-hgm3.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hx79-x87c-hgm3",
"modified": "2022-05-24T17:21:18Z",
"published": "2022-05-24T17:21:18Z",
"aliases": [
"CVE-2020-5590"
],
"details": "Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5590"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN77458946/index.html"
},
{
"type": "WEB",
"url": "https://www.ec-cube.net/info/weakness/weakness.php?id=73"
},
{
"type": "WEB",
"url": "https://www.ec-cube.net/info/weakness/weakness.php?id=74"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-19T10:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-vrpv-26fm-7vf7/GHSA-vrpv-26fm-7vf7.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vrpv-26fm-7vf7",
"modified": "2022-05-24T19:06:27Z",
"published": "2022-05-24T19:06:27Z",
"aliases": [
"CVE-2021-20750"
],
"details": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20750"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN95292458/index.html"
},
{
"type": "WEB",
"url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
},
{
"type": "WEB",
"url": "https://www.ec-cube.net/info/weakness/weakness.php?id=79"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-28T01:15:00Z"
}
}