netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-m6cj-xcv2-9mc9
GHSA-mhhh-m8rq-6x3v
GHSA-ph7w-3qv5-6r8m
GHSA-vmr9-p7gj-v77h
GHSA-w42f-w92v-v257
GHSA-w693-p92h-8rxr
This commit is contained in:
advisory-database[bot]
2024-10-20 03:31:39 +00:00
parent 916f419e7f
commit 40cba301bb
6 changed files with 336 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/10/GHSA-m6cj-xcv2-9mc9/GHSA-m6cj-xcv2-9mc9.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m6cj-xcv2-9mc9",
"modified": "2024-10-20T03:30:31Z",
"published": "2024-10-20T03:30:31Z",
"aliases": [
"CVE-2024-10165"
],
"details": "A vulnerability was found in Codezips Sales Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file deletecustcom.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10165"
},
{
"type": "WEB",
"url": "https://github.com/ppp-src/CVE/issues/14"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.280951"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.280951"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.425636"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-20T03:15:02Z"
}
}
advisories/unreviewed/2024/10/GHSA-mhhh-m8rq-6x3v/GHSA-mhhh-m8rq-6x3v.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mhhh-m8rq-6x3v",
"modified": "2024-10-20T03:30:32Z",
"published": "2024-10-20T03:30:32Z",
"aliases": [
"CVE-2024-10167"
],
"details": "A vulnerability classified as critical has been found in Codezips Sales Management System 1.0. This affects an unknown part of the file deletecustind.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10167"
},
{
"type": "WEB",
"url": "https://github.com/ppp-src/CVE/issues/16"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.280953"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.280953"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.425650"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-20T03:15:03Z"
}
}
advisories/unreviewed/2024/10/GHSA-ph7w-3qv5-6r8m/GHSA-ph7w-3qv5-6r8m.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-ph7w-3qv5-6r8m",
"modified": "2024-10-20T03:30:31Z",
"published": "2024-10-20T03:30:31Z",
"aliases": [
"CVE-2024-10163"
],
"details": "A vulnerability was found in SourceCodester Sentiment Based Movie Rating System 1.0. It has been classified as critical. Affected is an unknown function of the file /msrps/movie_details.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher disclosure mentions a slightly changed product name.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10163"
},
{
"type": "WEB",
"url": "https://github.com/2967607153/CVE-report/blob/main/Sourcecodester-SQLi-Sentiment-Based-Moive-Rating.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.280950"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.280950"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.425464"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-20T02:15:01Z"
}
}
advisories/unreviewed/2024/10/GHSA-vmr9-p7gj-v77h/GHSA-vmr9-p7gj-v77h.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vmr9-p7gj-v77h",
"modified": "2024-10-20T03:30:31Z",
"published": "2024-10-20T03:30:31Z",
"aliases": [
"CVE-2024-10161"
],
"details": "A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. This affects an unknown part of the file change-image.php of the component Update Boat Image Page. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10161"
},
{
"type": "WEB",
"url": "https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_change_image_file_upload_rce.md"
},
{
"type": "WEB",
"url": "https://phpgurukul.com"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.280947"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.280947"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.425440"
}
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-20T01:15:01Z"
}
}
advisories/unreviewed/2024/10/GHSA-w42f-w92v-v257/GHSA-w42f-w92v-v257.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w42f-w92v-v257",
"modified": "2024-10-20T03:30:31Z",
"published": "2024-10-20T03:30:31Z",
"aliases": [
"CVE-2024-10162"
],
"details": "A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/edit-subadmin.php of the component Edit Subdomain Details Page. The manipulation of the argument sadminusername/fullname/emailid/mobilenumber leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter \"mobilenumber\" to be affected. But it must be assumed that other parameters are affected as well.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10162"
},
{
"type": "WEB",
"url": "https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_edit_subadmin_sqli.md"
},
{
"type": "WEB",
"url": "https://phpgurukul.com"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.280948"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.280948"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.425449"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-20T01:15:02Z"
}
}
advisories/unreviewed/2024/10/GHSA-w693-p92h-8rxr/GHSA-w693-p92h-8rxr.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w693-p92h-8rxr",
"modified": "2024-10-20T03:30:32Z",
"published": "2024-10-20T03:30:32Z",
"aliases": [
"CVE-2024-10166"
],
"details": "A vulnerability was found in Codezips Sales Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file checkuser.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10166"
},
{
"type": "WEB",
"url": "https://github.com/ppp-src/CVE/issues/15"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.280952"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.280952"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.425643"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-20T03:15:02Z"
}
}