netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-4h85-vpxq-834q
GHSA-9w3h-593p-q56r
GHSA-m3mr-pjj3-2g74
GHSA-m525-p4rf-7h93
GHSA-q87w-hjgf-6vfw
This commit is contained in:
advisory-database[bot]
2024-01-29 12:31:18 +00:00
parent 1afcf02bc9
commit 304bb6bf5d
5 changed files with 199 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/01/GHSA-4h85-vpxq-834q/GHSA-4h85-vpxq-834q.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4h85-vpxq-834q",
"modified": "2024-01-29T12:30:20Z",
"published": "2024-01-29T12:30:20Z",
"aliases": [
"CVE-2024-23792"
],
"details": "When adding attachments to ticket comments, \nanother user can add attachments as well impersonating the orginal user. The attack requires a \nlogged-in other user to know the UUID. While the legitimate user \ncompletes the comment, the malicious user can add more files to the \ncomment.\n\nThis issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23792"
},
{
"type": "WEB",
"url": "https://otrs.com/release-notes/otrs-security-advisory-2024-03/"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-29T10:15:08Z"
}
}
advisories/unreviewed/2024/01/GHSA-9w3h-593p-q56r/GHSA-9w3h-593p-q56r.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9w3h-593p-q56r",
"modified": "2024-01-29T12:30:20Z",
"published": "2024-01-29T12:30:20Z",
"aliases": [
"CVE-2023-5378"
],
"details": "Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2 (newer versions were not tested; the vendor has not confirmed fixing the vulnerability). \n\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5378"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2023/12/CVE-2023-5378"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2023/12/CVE-2023-5378"
},
{
"type": "WEB",
"url": "https://megabip.pl/"
},
{
"type": "WEB",
"url": "https://smod.pl/"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-29T12:15:07Z"
}
}
advisories/unreviewed/2024/01/GHSA-m3mr-pjj3-2g74/GHSA-m3mr-pjj3-2g74.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m3mr-pjj3-2g74",
"modified": "2024-01-29T12:30:20Z",
"published": "2024-01-29T12:30:20Z",
"aliases": [
"CVE-2023-46838"
],
"details": "Transmit requests in Xen's virtual network protocol can consist of\nmultiple parts. While not really useful, except for the initial part\nany of them may be of zero length, i.e. carry no data at all. Besides a\ncertain initial portion of the to be transferred data, these parts are\ndirectly translated into what Linux calls SKB fragments. Such converted\nrequest parts can, when for a particular SKB they are all of length\nzero, lead to a de-reference of NULL in core networking code.\n",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46838"
},
{
"type": "WEB",
"url": "https://xenbits.xenproject.org/xsa/advisory-448.html"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-29T11:15:07Z"
}
}
advisories/unreviewed/2024/01/GHSA-m525-p4rf-7h93/GHSA-m525-p4rf-7h93.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m525-p4rf-7h93",
"modified": "2024-01-29T12:30:20Z",
"published": "2024-01-29T12:30:20Z",
"aliases": [
"CVE-2024-23790"
],
"details": "Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes.\nThis issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.1.1.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23790"
},
{
"type": "WEB",
"url": "https://otrs.com/release-notes/otrs-security-advisory-2024-01/"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-29T10:15:08Z"
}
}
advisories/unreviewed/2024/01/GHSA-q87w-hjgf-6vfw/GHSA-q87w-hjgf-6vfw.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q87w-hjgf-6vfw",
"modified": "2024-01-29T12:30:20Z",
"published": "2024-01-29T12:30:20Z",
"aliases": [
"CVE-2024-23791"
],
"details": "Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23791"
},
{
"type": "WEB",
"url": "https://otrs.com/release-notes/otrs-security-advisory-2024-02/"
}
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-29T10:15:08Z"
}
}