netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-j9g7-mqhh-9hxf
GHSA-rm69-wvpv-r2w7
GHSA-v464-r2r9-www7
This commit is contained in:
advisory-database[bot]
2025-03-21 17:26:16 +00:00
parent 17b784dced
commit 4171f8e388
3 changed files with 93 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/03/GHSA-j9g7-mqhh-9hxf/GHSA-j9g7-mqhh-9hxf.json → advisories/github-reviewed/2025/03/GHSA-j9g7-mqhh-9hxf/GHSA-j9g7-mqhh-9hxf.json
+33 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j9g7-mqhh-9hxf",
"modified": "2025-03-20T12:32:40Z",
"modified": "2025-03-21T17:24:48Z",
"published": "2025-03-20T12:32:40Z",
"aliases": [
"CVE-2024-10833"
],
"summary": "DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload",
"details": "eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the 'doc_file.filename' parameter is user-controllable, enabling the construction of absolute paths.",
"severity": [
{
@@ -13,12 +14,40 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "dbgpt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10833"
},
{
"type": "WEB",
"url": "https://github.com/eosphoros-ai/DB-GPT/commit/780ce803e325b87f4ddfbe5824451e379aeee56c"
},
{
"type": "PACKAGE",
"url": "https://github.com/eosphoros-ai/DB-GPT"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/dc58e981-e325-4c11-b4e1-1095890fd15a"
@@ -29,8 +58,8 @@
"CWE-22"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T17:24:47Z",
"nvd_published_at": "2025-03-20T10:15:20Z"
}
}
advisories/unreviewed/2025/03/GHSA-rm69-wvpv-r2w7/GHSA-rm69-wvpv-r2w7.json → advisories/github-reviewed/2025/03/GHSA-rm69-wvpv-r2w7/GHSA-rm69-wvpv-r2w7.json
+31 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rm69-wvpv-r2w7",
"modified": "2025-03-20T12:32:43Z",
"modified": "2025-03-21T17:25:31Z",
"published": "2025-03-20T12:32:42Z",
"aliases": [
"CVE-2024-12215"
],
"summary": "Kedro allows Remote Code Execution by Pulling Micro Packages",
"details": "In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "kedro"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.19.8"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12215"
},
{
"type": "PACKAGE",
"url": "https://github.com/kedro-org/kedro"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/fad27503-97a4-4933-91d4-96223b8c54d8"
@@ -26,11 +51,12 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-829"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T17:25:31Z",
"nvd_published_at": "2025-03-20T10:15:27Z"
}
}
advisories/unreviewed/2025/03/GHSA-v464-r2r9-www7/GHSA-v464-r2r9-www7.json → advisories/github-reviewed/2025/03/GHSA-v464-r2r9-www7/GHSA-v464-r2r9-www7.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v464-r2r9-www7",
"modified": "2025-03-20T12:32:44Z",
"modified": "2025-03-21T17:25:07Z",
"published": "2025-03-20T12:32:44Z",
"aliases": [
"CVE-2024-12886"
],
"summary": "Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP",
"details": "An Out-Of-Memory (OOM) vulnerability exists in the `ollama` server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the `ollama` server crashing. The vulnerability is present in the `makeRequestWithRetry` and `getAuthorizationToken` functions, which use `io.ReadAll` to read the response body. This can result in excessive memory usage and a Denial of Service (DoS) condition.",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/ollama/ollama"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.3.14"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12886"
},
{
"type": "PACKAGE",
"url": "https://github.com/ollama/ollama"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/f115fe52-58af-4844-ad29-b1c25f7245df"
@@ -29,8 +54,8 @@
"CWE-400"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T17:25:07Z",
"nvd_published_at": "2025-03-20T10:15:31Z"
}
}