Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-05 05:12:02 +00:00
parent 7e890baa85
commit 3bf5e8df6a
947 changed files with 1249 additions and 3747 deletions
@@ -3,14 +3,10 @@
  "id": "GHSA-7p79-6x2v-5h88",
  "modified": "2022-02-25T14:54:31Z",
  "published": "2022-02-16T22:57:57Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Server crash if running Python 3.10 w/ Sanic 20.12",
  "details": "**!!! ONLY APPLIES TO VERSIONS PRIOR TO Sanic v20.12 WHEN USING Python 3.10 !!!**\n\nSanic v20.12 officially supports Python versions 3.6, 3.7, 3.8, and 3.9. However, if you accidentally run it with version 3.10 (**which is not supported by Sanic 20.12**), your server is prone to crashing on an incoming web request.\n\n### Impact\nAnyone running Sanic server between 0.1.7 and 20.12 **using Python 3.10**.\n\n### Patches\n[Sanic v20.12.6](https://github.com/sanic-org/sanic/releases/tag/v20.12.6)\n\n### Workarounds\nUse a supported version of Python (v3.6 - v3.9)\n\n### References\n> In [asyncio](https://docs.python.org/3/library/asyncio.html#module-asyncio), the explicit passing of a loop argument has been deprecated and will be removed in version 3.10 for the following: ... [asyncio.Event](https://docs.python.org/3/library/asyncio-sync.html#asyncio.Event)\n\n[Python 3.8 Release Notes](https://docs.python.org/3/whatsnew/3.8.html#deprecated)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the community forums](https://community.sanicframework.org/)\n* Ping us on [the Discord server](https://discord.gg/FARQzAEMAA)\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -47,9 +43,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-02-16T22:57:57Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "TYPO3 Cross-site scripting (XSS) vulnerability in the Backend User Administration Module ",
  "details": "Cross-site scripting (XSS) vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "MoinMoin has improper default configuration",
  "details": "The default configuration of `cfg.packagepages_actions_excluded` in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -75,9 +73,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-29T11:18:54Z",
@@ -107,9 +107,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-08T18:57:43Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Subrion CMS vulnerable to Cross Site Scripting ",
  "details": "Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -47,9 +45,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-27T21:48:36Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Apache Ambari XML External Entity injection",
  "details": "XML External Entity injection in Apache Ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue.\n\nMore Details:\n\nOozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The vulnerability was caused through lack of proper user input validation.\n\nThis vulnerability is known as an XML External Entity (XXE) injection attack. Attackers can exploit XXE vulnerabilities to read arbitrary files on the server, including sensitive system files. In theory, it might be possible to use this to escalate privileges.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-x5r5-2qrx-rqj8",
  "modified": "2024-02-27T19:02:15Z",
  "published": "2024-02-27T19:02:15Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Transparent TLS may not be applied to Marbles with certain manifest configurations",
  "details": "Transparent TLS (TTLS) is a MarbleRun feature that wraps plain TCP connections between Marbles in TLS.\nIn the manifest, a user defines the connections that should be considered.\n\n### Impact\nIf a Marble is configured for TTLS, but doesn't have an environment variable defined in its parameters, TTLS is not applied.\nThe traffic will not be encrypted.\n\nMarbleRun deployments that don't use TTLS (which is only available with EGo Marbles) are not affected.\n\n### Patches\nThe issue has been patched in [`v1.4.1`](https://github.com/edgelesssys/marblerun/releases/tag/v1.4.1).\n\n### Workarounds\nMake sure that all Marbles that use TTLS have an environment variable defined in their parameters.\n\n### References\nFor a description of TTLS, see <https://docs.edgeless.systems/marblerun/features/transparent-TLS>\nSee the updated section on TTLS configuration in the manifest: <https://docs.edgeless.systems/marblerun/workflows/define-manifest#tls> \n",
  "severity": [
@@ -58,9 +56,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-27T19:02:15Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters",
  "details": "### Summary\n\nIn the WASMI Interpreter, an [Out-of-bounds Buffer Write](https://cwe.mitre.org/data/definitions/787.html) will arise arise if the host calls or resumes a Wasm function with more parameters than the default limit (128), as it will surpass the stack value. This doesn’t affect calls from Wasm to Wasm, only from host to Wasm.\n\n### Impact\n\nAfter conducting an analysis of the dependent Polkadot systems of `wasmi`: [Pallet Contracts](https://github.com/paritytech/polkadot-sdk/tree/master/substrate/frame/contracts), [Parity Signer](https://github.com/paritytech/parity-signer), and [Smoldot](https://github.com/smol-dot/smoldot), we have found that none on those systems have been affected by the issue as they are calling host to Wasm function with a small limited amount of parameters always. \n\n### Mitigations\n\nIf you are using `wasmi` betwen version 0.15.0 and 0.31.0, please update it to the [0.31.1](https://github.com/paritytech/wasmi/releases/tag/v0.31.1) patch release that we just published.\n\n### Workarounds\n\nEnsure no more than 128 parameters can be pass in a call from the host to a Wasm function. \n\n### References\n\nPatch PR: <PR>\n\n### Special thanks\n\nSpecial thanks to Stellar Development Foundation for reporting this security vulnerability.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-2f46-4xjm-73x5",
  "modified": "2024-05-20T17:07:44Z",
  "published": "2024-05-20T17:07:44Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Passbolt API Stored XSS on first/last name during setup",
  "details": "### Description\nAn administrator can craft a user with a malicious first name and last name, using a payload such as\n```\n<svg onload=\"confirm(document.domain)\">'); ?></svg>\n```\nThe user will then receive the invitation email and click on the setup link. The setup start page served by the server will fire the XSS.\n\n### Impact of issue\nAn administrator could use this exploit to edit the setup start page for a given user, for example, trick the user into installing another extension. Even though the severity of this issue in itself is high, the likelihood is low because the exploit will be visible in clear by the user in the email notification, and also requires an action from a malicious administrator.\n\n### Fix\nSanitize the firstname and lastname in the page that is used to trigger the extension setup process.\n\nAdditionally since v2.11 some default CSP are inserted in the server response headers to prevent inline-scripts or 3rd party domain scripts on pages served by the passbolt API. This is to cater for the case where the administrator has not set them up as part of the web server configuration.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-3vhm-q4w3-rw8q",
  "modified": "2024-05-20T14:22:10Z",
  "published": "2024-05-20T14:22:09Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "OroPlatform Forced Redirect to External Website",
  "details": "OroPlatform is prone to open redirection which could allow attackers to redirect users to external website.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-7g7c-qhf3-x59p",
  "modified": "2024-05-20T17:36:29Z",
  "published": "2024-05-20T17:36:28Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "propel/propel1 SQL injection possible with limit() on MySQL",
  "details": "The limit() query method is susceptible to catastrophic SQL injection with MySQL.\n\nFor example, given a model User for a table users:\n```\nUserQuery::create()->limit('1;DROP TABLE users')->find();\n```\nThis will drop the users table!\n\nThe cause appears to be a lack of integer casting of the limit input in either Criteria::setLimit() or in DBMySQL::applyLimit(). The code comments there seem to imply that casting was avoided due to overflow issues with 32-bit integers.\n\nThis is surprising behavior since one of the primary purposes of an ORM is to prevent basic SQL injection.\n\nThis affects all versions of Propel: 1.x, 2.x, and 3.",
  "severity": [
@@ -4,9 +4,7 @@
  "modified": "2024-05-20T20:17:03Z",
  "published": "2024-05-20T09:30:50Z",
  "withdrawn": "2024-05-20T20:17:03Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: Scrapy leaks the authorization header on same-domain but cross-origin redirects ",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-4qqq-9vqf-3h3f. This link is maintained to preserve external references.\n\n## Original Description\nIn scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in cross-origin requests when the scheme, host, or port changes. Consequently, when a redirect downgrades from HTTPS to HTTP, the Authorization header may be inadvertently exposed in plaintext, leading to potential sensitive information disclosure to unauthorized actors. The flaw is located in the _build_redirect_request function of the redirect middleware.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-cv5c-2qv5-w2m2",
  "modified": "2024-05-20T16:51:28Z",
  "published": "2024-05-20T16:51:28Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Passbolt Api Remote code execution",
  "details": "Passbolt provides a way for system administrators to generate a PGP key for the server during installation. The wizard requests a username, an e-mail address and an optional comment. No escaping or verification is done by Passbolt, effectively allowing a user to inject bash code.\n\nThe impact is very high, but the probability is very low given that this vulnerability can only be exploited during Passbolt’s installation stage.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-f5pp-pmq8-gp46",
  "modified": "2024-05-20T16:51:24Z",
  "published": "2024-05-20T16:51:24Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Passbolt Api Retrieval of HTTP-only cookies",
  "details": "Passbolt uses three cookies: a session cookie, a CSRF protection cookie and a cookie to keep track of the multiple-factor authentication process.\n\nBoth the session cookie and the mfa cookie are properly set HTTP-only to prevent an attacker from retrieving the content of those cookies if they managed to exploit an XSS.\n\nThe /auth/verify.json endpoint returns a JSON that, among other things, contains the cookies sent in the request. (similar to the TRACE HTTP method)\n\nAn attacker who manages to leverage an XSS vulnerability could retrieve the session cookies of a legitimate user, effectively granting them the ability to retrieve information (such as encrypted password list or group list) without requiring user interaction.\n\nThis vulnerability has a low impact, but no immediate risk due to it requiring the exploitation of an XSS vulnerability that has yet to be found.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-qm5v-pj64-852j",
  "modified": "2024-05-20T17:09:57Z",
  "published": "2024-05-20T17:09:57Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Passbolt Api Tabnabbing when opening URI with menu \"Open URI in a new tab\"",
  "details": "### Description\nA user could create and share a resource with a malicious URI. When the victim opens with menu “Open URI in a new tab” function, the malicious page has access to the window.opener object.\n\n### Impact of issue\nThe newly opened malicious page can for example change the window.opener.location to redirect the user to a phishing page, or call a JavaScript function served by the AppJS on the user behalf for example to try to affect the integrity of the data.\n\n### Fix\nThe code that opens a new window via window.open(); now open the tab with the noopener attribute.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-v86m-j5f7-ccwh",
  "modified": "2024-05-20T16:51:20Z",
  "published": "2024-05-20T16:51:20Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Passbolt Api E-mail HTML injection",
  "details": "Passbolt sends e-mail to users to warn them about different type of events such as the creation, modification or deletion of a password. Those e-mails may contain user-specified input, such as a password’s title or description.\n\nPassbolt does not escape the user’s input properly, resulting in the user being able to inject HTML code in an e-mail.\n\nAn authenticated attacker could share a password containing an img HTML tag in its description with an other user to obtain information about their mail user-agent.\n\nThis vulnerability has a very low impact. Most MUA do not embed remote images to protect their users’ privacy.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-v8hp-239v-9367",
  "modified": "2024-05-20T14:19:27Z",
  "published": "2024-05-20T14:19:27Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "OroCRM Forced Redirect to External Website",
  "details": "OroCRM is prone to open redirection which could allow attackers to redirect users to external website.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-ww6p-q26w-fr6m",
  "modified": "2024-05-20T17:14:55Z",
  "published": "2024-05-20T17:14:55Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "phpxmlrpc/extra XSS in class documenting_xmlrpc_server",
  "details": "Versions preceding 0.6.1 of the phpxmlrpc/extras project are susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability exists within the class documenting_xmlrpc_server when processing the GET methodName parameter.",
  "severity": [
@@ -7,12 +7,8 @@
    "CVE-2022-24983"
  ],
  "details": "Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by capturing the POST response. When chained with CVE-2022-24984, this could lead to unauthenticated remote code execution on the underlying web server. This occurs because the Unique ID field is contained in the POST response upon submitting a form.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
--- a/Show More
+++ b/Show More