Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-07 05:22:18 +00:00
parent 8e5775d432
commit 36b3b85c2d
957 changed files with 1898 additions and 5694 deletions
@@ -60,9 +60,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-19T15:03:22Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-32gv-6cf3-wcmq",
  "modified": "2022-03-14T22:45:11Z",
  "published": "2022-03-14T22:45:11Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods",
  "details": "### Impact\nTwisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities:\n\nPing flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512\nReset flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514\nSettings flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9515\n\nA Twisted web server supports HTTP/2 requests if you've installed the [`http2` optional dependency set](https://twistedmatrix.com/documents/19.2.0/installation/howto/optional.html).\n\n### Workarounds\nThere are no workarounds.\n\n### References\nhttps://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Twisted's Trac](https://twistedmatrix.com/trac/)\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -52,9 +48,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-14T22:45:11Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "phpMyAdmin Open Redirect in redirector",
  "details": "Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before 3.4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-x477-fq37-q5wr",
  "modified": "2023-01-27T00:55:27Z",
  "published": "2023-01-27T00:55:27Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Initial debug-host handler implementation could leak information and facilitate denial of service",
  "details": "### Impact\nversion 1.5.0 and 1.6.0 when using the new `debug-host` feature could expose unnecessary information about the host\n\n### Patches\nUse 1.6.1 or newer\n\n### Workarounds\nDowngrade to 1.4.0 or set `debug-host` to empty\n\n### References\nhttps://github.com/fortio/proxy/pull/38\n\nQ&A https://github.com/fortio/proxy/discussions",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-7cgc-fjv4-52x6",
  "modified": "2023-05-24T16:43:58Z",
  "published": "2023-05-24T16:43:58Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malware in pre-build binaries of bignum",
  "details": "### Impact\n\nbignum releases from v0.12.2 to v0.13.0 (inclusive) used node-pre-gyp to optionally download pre-built binary versions of the addon. These binaries were published on a now-expired S3 bucket which has since been claimed by a malicious third party which is now serving binaries containing malware that exfiltrates data from the user's computer.\n\n### Patches\n\nv0.13.1 does not use node-pre-gyp and does not have support for downloading pre-built binaries in any form, avoiding the risk of malicious downloads.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -46,9 +46,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-17T03:24:54Z",
@@ -4,9 +4,7 @@
  "modified": "2024-04-15T19:42:12Z",
  "published": "2024-02-13T18:38:24Z",
  "withdrawn": "2024-02-13T19:49:31Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2024-21386: .NET Denial of Service Vulnerability",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-g74q-5xw3-j7q9. This link is maintained to preserve external references.\n\n## Original Description\n.NET Denial of Service Vulnerability",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-x5j2-g63m-f8g4",
  "modified": "2024-04-15T19:41:48Z",
  "published": "2024-02-09T16:19:53Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "pqc_kyber KyberSlash: division timings depending on secrets",
  "details": "Various Kyber software libraries in various environments leak secret information into timing, specifically because\n\n * these libraries include a line of code that divides a secret numerator by a public denominator,\n * the number of CPU cycles for division in various environments varies depending on the inputs to the division, and\n * this variation appears within the range of numerators used in these libraries.\n\nThe KyberSlash pages track which Kyber [libraries](https://kyberslash.cr.yp.to/libraries.html) have this issue, and include a [FAQ](https://kyberslash.cr.yp.to/faq.html) about the issue.\n\n## Author\n\nThe KyberSlash pages were written by Daniel J. Bernstein. The FAQ originally said \"I\", but some people seemed to have trouble finding this authorship statement, so the FAQ now says \"Bernstein\" instead.\n\n## URL\n\nThe permanent link for the KyberSlash pages is [https://kyberslash.cr.yp.to](https://kyberslash.cr.yp.to).\n\n## Mitigation status in pqc_kyber crate\n\nThe issues has not been resolved in the `pqc_kyber` crate. A third-party fork that mitigates this attack vector has been published as [`safe_pqc_kyber`](https://crates.io/crates/safe_pqc_kyber).\n",
  "severity": [
@@ -54,9 +52,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-09T16:19:53Z",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -63,9 +61,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2012-3837"
  ],
  "details": "Multiple cross-site scripting (XSS) vulnerabilities in apps/users/registration.template.php in Baby Gekko 1.2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) email_address, (3) password, (4) password_verify, (5) firstname, (6) lastname, or (7) verification_code parameter to users/action/register.  NOTE: some of these details are obtained from third party information.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2011-5113"
  ],
  "details": "SQL injection vulnerability in frontend/models/techfoliodetail.php in Techfolio (com_techfolio) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
--- a/Show More
+++ b/Show More