netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-07-03 18:40:52 +00:00
parent 8249bca0f5
commit 37e28da531
204 changed files with 1311 additions and 736 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/05/GHSA-2252-jwp3-qxfh/GHSA-2252-jwp3-qxfh.json
+1 -1
View File
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"severity": "CRITICAL",
"github_reviewed": false,
advisories/unreviewed/2024/05/GHSA-26cg-rw99-22rc/GHSA-26cg-rw99-22rc.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-26cg-rw99-22rc",
"modified": "2024-05-01T21:30:34Z",
"modified": "2024-07-03T18:38:20Z",
"published": "2024-05-01T21:30:34Z",
"aliases": [
"CVE-2023-23019"
],
"details": "Cross site scripting (XSS) vulnerability in file main.php in sourcecodester oretnom23 Blog Site 1.0 via the name and email parameters to function user_add.\\",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-01T19:15:20Z"
advisories/unreviewed/2024/05/GHSA-2769-9cr9-9w7h/GHSA-2769-9cr9-9w7h.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2769-9cr9-9w7h",
"modified": "2024-05-07T18:30:34Z",
"modified": "2024-07-03T18:39:35Z",
"published": "2024-05-07T18:30:34Z",
"aliases": [
"CVE-2024-33155"
],
"details": "J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T17:15:09Z"
advisories/unreviewed/2024/05/GHSA-2cf3-8v44-39fh/GHSA-2cf3-8v44-39fh.json
+1 -1
View File
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "LOW",
"github_reviewed": false,
advisories/unreviewed/2024/05/GHSA-2f36-cx3x-62vx/GHSA-2f36-cx3x-62vx.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2f36-cx3x-62vx",
"modified": "2024-05-07T21:31:47Z",
"modified": "2024-07-03T18:39:50Z",
"published": "2024-05-07T21:31:47Z",
"aliases": [
"CVE-2024-23710"
],
"details": "In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execution of arbitrary app code as a privileged app due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T21:15:08Z"
advisories/unreviewed/2024/05/GHSA-2jv5-xv66-fhx8/GHSA-2jv5-xv66-fhx8.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2jv5-xv66-fhx8",
"modified": "2024-05-03T18:30:37Z",
"modified": "2024-07-03T18:38:48Z",
"published": "2024-05-03T18:30:37Z",
"aliases": [
"CVE-2024-33791"
],
"details": "A cross-site scripting (XSS) vulnerability in netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the getTimeZone function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T17:15:08Z"
advisories/unreviewed/2024/05/GHSA-2r4f-jfx8-mhm3/GHSA-2r4f-jfx8-mhm3.json
+1
View File
@@ -32,6 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-120",
"CWE-306"
],
"severity": "MODERATE",
advisories/unreviewed/2024/05/GHSA-2r9m-fc3w-cxph/GHSA-2r9m-fc3w-cxph.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2r9m-fc3w-cxph",
"modified": "2024-05-14T15:32:54Z",
"modified": "2024-07-03T18:40:25Z",
"published": "2024-05-14T15:32:54Z",
"aliases": [
"CVE-2024-29161"
],
"details": "HDF5 through 1.14.3 contains a heap buffer overflow in H5A__attr_release_table, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T15:15:32Z"
advisories/unreviewed/2024/05/GHSA-2w87-6hh6-mqrj/GHSA-2w87-6hh6-mqrj.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2w87-6hh6-mqrj",
"modified": "2024-06-13T21:30:36Z",
"modified": "2024-07-03T18:39:51Z",
"published": "2024-05-07T21:31:47Z",
"aliases": [
"CVE-2024-4030"
],
"details": "On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions.\n\nIf you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user.\n\nThis issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
@@ -79,7 +82,7 @@
"cwe_ids": [
"CWE-276"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T21:15:09Z"
advisories/unreviewed/2024/05/GHSA-2w94-phv7-xjw4/GHSA-2w94-phv7-xjw4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2w94-phv7-xjw4",
"modified": "2024-05-06T18:30:34Z",
"modified": "2024-07-03T18:39:09Z",
"published": "2024-05-06T18:30:34Z",
"aliases": [
"CVE-2024-26312"
],
"details": "Archer Platform 6 before 2024.03 contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-06T16:15:13Z"
advisories/unreviewed/2024/05/GHSA-32r2-xfqh-9qx6/GHSA-32r2-xfqh-9qx6.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-32r2-xfqh-9qx6",
"modified": "2024-05-14T18:30:44Z",
"modified": "2024-07-03T18:40:07Z",
"published": "2024-05-14T18:30:44Z",
"aliases": [
"CVE-2022-32508"
],
"details": "An issue was discovered on certain Nuki Home Solutions devices. By sending a malformed HTTP verb, it is possible to force a reboot of the device. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T10:43:41Z"
advisories/unreviewed/2024/05/GHSA-339j-p2wf-p72r/GHSA-339j-p2wf-p72r.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-339j-p2wf-p72r",
"modified": "2024-05-08T15:30:42Z",
"modified": "2024-07-03T18:39:57Z",
"published": "2024-05-08T15:30:42Z",
"aliases": [
"CVE-2024-25525"
],
"details": "RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownload.aspx.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-08T15:15:08Z"
advisories/unreviewed/2024/05/GHSA-33r5-hf6m-mc27/GHSA-33r5-hf6m-mc27.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-33r5-hf6m-mc27",
"modified": "2024-05-06T15:30:39Z",
"modified": "2024-07-03T18:39:08Z",
"published": "2024-05-06T15:30:39Z",
"aliases": [
"CVE-2024-33294"
],
"details": "An issue in Library System using PHP/MySQli with Source Code V1.0 allows a remote attacker to execute arbitrary code via the _FAILE variable in the student_edit_photo.php component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-06T15:15:23Z"
advisories/unreviewed/2024/05/GHSA-377p-g8gr-5wpg/GHSA-377p-g8gr-5wpg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-377p-g8gr-5wpg",
"modified": "2024-05-03T18:30:37Z",
"modified": "2024-07-03T18:38:47Z",
"published": "2024-05-03T18:30:37Z",
"aliases": [
"CVE-2024-31636"
],
"details": "An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-457"
],
"severity": null,
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T17:15:07Z"
advisories/unreviewed/2024/05/GHSA-37jj-p98x-q9ff/GHSA-37jj-p98x-q9ff.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-37jj-p98x-q9ff",
"modified": "2024-05-07T21:31:46Z",
"modified": "2024-07-03T18:39:46Z",
"published": "2024-05-07T21:31:46Z",
"aliases": [
"CVE-2024-23705"
],
"details": "In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T21:15:08Z"
advisories/unreviewed/2024/05/GHSA-3849-33qq-vw2c/GHSA-3849-33qq-vw2c.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3849-33qq-vw2c",
"modified": "2024-05-01T21:30:38Z",
"modified": "2024-07-03T18:38:30Z",
"published": "2024-05-01T21:30:38Z",
"aliases": [
"CVE-2024-33423"
],
"details": "Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language section.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-80"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-01T20:15:12Z"
advisories/unreviewed/2024/05/GHSA-38f9-jc9v-rgw6/GHSA-38f9-jc9v-rgw6.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-38f9-jc9v-rgw6",
"modified": "2024-05-02T18:30:51Z",
"modified": "2024-07-03T18:38:44Z",
"published": "2024-05-02T18:30:51Z",
"aliases": [
"CVE-2024-32359"
],
"details": "An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtain the secrets of the entire cluster and further take over the cluster.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-285"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-02T16:15:08Z"
advisories/unreviewed/2024/05/GHSA-39cp-8qfj-8cjm/GHSA-39cp-8qfj-8cjm.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-39cp-8qfj-8cjm",
"modified": "2024-05-01T21:30:38Z",
"modified": "2024-07-03T18:38:27Z",
"published": "2024-05-01T21:30:38Z",
"aliases": [
"CVE-2024-33431"
],
"details": "An issue in phiola/src/afilter/conv.c:115 of phiola v2.0-rc22 allows a remote attacker to cause a denial of service via a crafted .wav file.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -49,9 +52,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-01T19:15:27Z"
advisories/unreviewed/2024/05/GHSA-39jg-cp5w-9278/GHSA-39jg-cp5w-9278.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-39jg-cp5w-9278",
"modified": "2024-05-08T15:30:42Z",
"modified": "2024-07-03T18:39:57Z",
"published": "2024-05-08T15:30:42Z",
"aliases": [
"CVE-2024-25524"
],
"details": "RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkPlan/WorkPlanAttachDownLoad.aspx.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-08T15:15:08Z"
advisories/unreviewed/2024/05/GHSA-3f3h-87pc-27hg/GHSA-3f3h-87pc-27hg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3f3h-87pc-27hg",
"modified": "2024-05-07T21:31:45Z",
"modified": "2024-07-03T18:39:40Z",
"published": "2024-05-07T21:31:44Z",
"aliases": [
"CVE-2024-25509"
],
"details": "RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_file_download.aspx.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T19:15:08Z"

Some files were not shown because too many files have changed in this diff Show More