netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-6mf6-7j75-2m6f
GHSA-c4cc-w454-4634
GHSA-j9rw-qm5f-r8xm
This commit is contained in:
advisory-database[bot]
2025-03-20 20:53:31 +00:00
parent ce8deba7bd
commit 3cddd557b2
3 changed files with 109 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/03/GHSA-6mf6-7j75-2m6f/GHSA-6mf6-7j75-2m6f.json → advisories/github-reviewed/2025/03/GHSA-6mf6-7j75-2m6f/GHSA-6mf6-7j75-2m6f.json
+33 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6mf6-7j75-2m6f",
"modified": "2025-03-20T12:32:48Z",
"modified": "2025-03-20T20:52:00Z",
"published": "2025-03-20T12:32:48Z",
"aliases": [
"CVE-2024-8556"
],
"summary": "AgentScope stored cross-site scripting (XSS) vulnerability",
"details": "A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to execute arbitrary JavaScript code in the context of the user's browser.",
"severity": [
{
@@ -13,12 +14,40 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "agentscope"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8556"
},
{
"type": "PACKAGE",
"url": "https://github.com/modelscope/agentscope"
},
{
"type": "WEB",
"url": "https://github.com/modelscope/agentscope/blob/21161fe9985ee2a2f617180b00a1424b81302d42/src/agentscope/studio/static/js/dashboard.js#L90"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/8439f16b-5256-4466-bb7d-371572572a4b"
@@ -29,8 +58,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-20T20:51:59Z",
"nvd_published_at": "2025-03-20T10:15:43Z"
}
}
advisories/unreviewed/2025/03/GHSA-c4cc-w454-4634/GHSA-c4cc-w454-4634.json → advisories/github-reviewed/2025/03/GHSA-c4cc-w454-4634/GHSA-c4cc-w454-4634.json
+42 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c4cc-w454-4634",
"modified": "2025-03-20T12:32:48Z",
"modified": "2025-03-20T20:51:49Z",
"published": "2025-03-20T12:32:48Z",
"aliases": [
"CVE-2024-8537"
],
"summary": "AgentScope path traversal vulnerability",
"details": "A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.",
"severity": [
{
@@ -13,12 +14,48 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "agentscope"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8537"
},
{
"type": "WEB",
"url": "https://github.com/modelscope/agentscope/pull/459"
},
{
"type": "WEB",
"url": "https://github.com/modelscope/agentscope/commit/7d285e862f86fa1d96ed04c4cd40a5f1b8f9189a"
},
{
"type": "PACKAGE",
"url": "https://github.com/modelscope/agentscope"
},
{
"type": "WEB",
"url": "https://github.com/modelscope/agentscope/blob/01530ee6a99c86426aab1be11ec3b3b86ca640ac/src/agentscope/studio/_app.py#L743"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/eeb8aa4b-e6e5-465c-b0dd-aa97e3b7dc09"
@@ -26,11 +63,12 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-29"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-20T20:51:49Z",
"nvd_published_at": "2025-03-20T10:15:42Z"
}
}
advisories/unreviewed/2025/03/GHSA-j9rw-qm5f-r8xm/GHSA-j9rw-qm5f-r8xm.json → advisories/github-reviewed/2025/03/GHSA-j9rw-qm5f-r8xm/GHSA-j9rw-qm5f-r8xm.json
+34 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j9rw-qm5f-r8xm",
"modified": "2025-03-20T12:32:48Z",
"modified": "2025-03-20T20:52:49Z",
"published": "2025-03-20T12:32:48Z",
"aliases": [
"CVE-2024-8551"
],
"summary": "AgentScope path traversal vulnerability in save-workflow",
"details": "A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.",
"severity": [
{
@@ -13,12 +14,40 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "agentscope"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8551"
},
{
"type": "PACKAGE",
"url": "https://github.com/modelscope/agentscope"
},
{
"type": "WEB",
"url": "https://github.com/modelscope/agentscope/blob/01530ee6a99c86426aab1be11ec3b3b86ca640ac/src/agentscope/studio/_app.py#L680"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/e0c0c294-f1e2-4f2c-a632-a9be9fd06989"
@@ -26,11 +55,12 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-23"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-20T20:52:49Z",
"nvd_published_at": "2025-03-20T10:15:43Z"
}
}