Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-05 05:17:39 +00:00
parent 054b40277e
commit 3233cee66e
964 changed files with 1257 additions and 3771 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "Active Record vulnerable to SQL Injection via nested query parameters",
  "details": "The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Active Record contains SQL Injection",
  "details": "SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Creme Fraiche contains OS Command Injection",
  "details": "The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment.  NOTE: some of these details are obtained from third party information.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "SQL Injection in Active Record",
  "details": "SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Gollum Exposure of Sensitive Information",
  "details": "The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-3fvf-2gp4-89wq",
  "modified": "2022-03-18T23:17:15Z",
  "published": "2022-03-18T23:17:15Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Possibility for Denial of Service by overwriting PHP files with language exports",
  "details": "### Impact\nLaravel Translation Manager didn't check the locale name, which allowed directory traversal when exporting files. The content would be a PHP file returning an array of translations, but this could lead to unexpected results, like denial of service. Access to the Laravel Translation Manager is required, because a new locale would have to be added and published.\n\n### Patches\nVersion 0.6.2 fixes this issue.\n\n### Workarounds\nOnly allow trusted admins to publish/edit translations.\n\n### References\nhttps://github.com/barryvdh/laravel-translation-manager/pull/417\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/barryvdh/laravel-translation-manager\n* Email me (see Github profile)\n\n### Credits\nFound and reported by [Natalia Trojanowska](https://www.linkedin.com/in/trojanowskanatalia/)",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -43,9 +39,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-18T23:17:15Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-46c5-pfj8-fv65",
  "modified": "2022-03-18T22:36:03Z",
  "published": "2022-03-18T22:36:03Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Improperly checked metadata on tools/armour itemstacks received from the client",
  "details": "### Impact\nDue to a workaround applied in 1.13, an attacker may send a negative damage/meta value in a tool or armour item's NBT, which `TypeConverter` then blindly uses as if it was valid without being checked.\n\nWhen this invalid metadata value reaches `Durable->setDamage()`, an exception is thrown because the metadata is not within the expected range for damage values.\n\nThis can be reproduced with either a too-large damage value, or a negative one.\n\n### Patches\nc8e1cfcbee4945fd4b63d2a7e96025c59744d4f1\n\n### Workarounds\nIn theory this can be checked by plugins using a custom `TypeConverter`, but this is likely to be very cumbersome.\n\n### For more information\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)\n",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-mgvv-5mxp-xq67",
  "modified": "2022-10-03T22:12:28Z",
  "published": "2022-10-03T22:12:28Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "SQLite3 addresses vulnerability in packaged version of libsqlite",
  "details": "### Summary\n\nThe rubygem sqlite3 v1.5.1 upgrades the packaged version of libsqlite from v3.39.3 to [v3.39.4](https://sqlite.org/releaselog/3_39_4.html).\n\nlibsqlite v3.39.4 addresses a vulnerability described as follows in the release notification:\n\n> Version 3.39.4 is a minimal patch against the prior release that addresses issues found since the\n> prior release. In particular, a potential vulnerability in the FTS3 extension has been fixed, so\n> this should be considered a security update.\n>\n> In order to exploit the vulnerability, an attacker must have full SQL access and must be able to\n> construct a corrupt database with over 2GB of FTS3 content. The problem arises from a 32-bit\n> signed integer overflow.\n\nThis vulnerability has not been assigned a CVE and does not have a severity declared.\n\nPlease note that this advisory only applies to the sqlite3 gem v1.5.0, and only if the packaged libsqlite is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libsqlite release announcements.\n\n\n### Mitigation\n\nUpgrade to the rubygem sqlite3 v1.5.1 or later.\n\nUsers who are unable to upgrade the sqlite3 gem may also choose a more complicated mitigation: compile and link sqlite3 against external libsqlite >= 3.39.4 which will also address these same issues.\n\n\n### References\n\n- Upstream release notes: https://sqlite.org/releaselog/3_39_4.html\n- Instructions for compiling against system libraries: https://github.com/sparklemotion/sqlite3-ruby",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -50,9 +46,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-03T22:12:28Z",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -27,9 +25,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -43,9 +41,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -27,9 +25,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
--- a/Show More
+++ b/Show More