netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2cf3-g243-hhfx
GHSA-7cwg-2575-3546
GHSA-mv8g-fhh6-6267
GHSA-qxm5-vx5j-pp6w
GHSA-whmq-cfm5-j8mj
GHSA-7cwg-2575-3546
GHSA-qxm5-vx5j-pp6w
This commit is contained in:
advisory-database[bot]
2024-04-22 22:59:05 +00:00
parent 33107779a2
commit 431e23333c
7 changed files with 381 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-2cf3-g243-hhfx/GHSA-2cf3-g243-hhfx.json → advisories/github-reviewed/2022/05/GHSA-2cf3-g243-hhfx/GHSA-2cf3-g243-hhfx.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2cf3-g243-hhfx",
"modified": "2022-05-13T01:45:43Z",
"modified": "2024-04-22T22:58:16Z",
"published": "2022-05-13T01:45:43Z",
"aliases": [
"CVE-2017-3590"
],
"summary": "MySQL Connectors Privilege Escalation",
"details": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 2.1.5 and earlier. Easily \"exploitable\" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mysql-connector-python"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3590"
},
{
"type": "PACKAGE",
"url": "https://github.com/mysql/mysql-connector-python"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
@@ -39,8 +62,8 @@
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:58:16Z",
"nvd_published_at": "2017-04-24T19:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-7cwg-2575-3546/GHSA-7cwg-2575-3546.json
+194
View File
@@ -0,0 +1,194 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7cwg-2575-3546",
"modified": "2024-04-22T22:57:56Z",
"published": "2022-05-13T01:39:57Z",
"aliases": [
"CVE-2017-0360"
],
"summary": "Tryton Information Disclosure Vulnerability",
"details": "file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a \"same root name but with a suffix\" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.17"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2.0"
},
{
"last_affected": "3.2.17"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4.0"
},
{
"last_affected": "3.4.17"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.6.0"
},
{
"last_affected": "3.6.16"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.8.0"
},
{
"last_affected": "3.8.14"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"last_affected": "4.0.9"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.4.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 4.2.2"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0360"
},
{
"type": "WEB",
"url": "https://github.com/tryton/trytond/commit/30e978593733385db3144f8c583eeb4679575cf0"
},
{
"type": "PACKAGE",
"url": "https://github.com/tryton/trytond"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-security-announce/2017/msg00084.html"
},
{
"type": "WEB",
"url": "http://hg.tryton.org/trytond?cmd=changeset;node=472510fdc6f8"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3826"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97489"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:57:56Z",
"nvd_published_at": "2017-04-04T17:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-mv8g-fhh6-6267/GHSA-mv8g-fhh6-6267.json → advisories/github-reviewed/2022/05/GHSA-mv8g-fhh6-6267/GHSA-mv8g-fhh6-6267.json
+65 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mv8g-fhh6-6267",
"modified": "2022-05-17T00:27:18Z",
"modified": "2024-04-22T22:58:32Z",
"published": "2022-05-17T00:27:18Z",
"aliases": [
"CVE-2016-9013"
],
"summary": "Django user with hardcoded password created when running tests on Oracle",
"details": "Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.",
"severity": [
{
@@ -14,13 +15,73 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "django"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.10"
},
{
"fixed": "1.10.3"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "django"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.9"
},
{
"fixed": "1.9.11"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "django"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.8"
},
{
"fixed": "1.8.16"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9013"
},
{
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ"
@@ -55,8 +116,8 @@
"CWE-798"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:58:32Z",
"nvd_published_at": "2016-12-09T20:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-qxm5-vx5j-pp6w/GHSA-qxm5-vx5j-pp6w.json
+73
View File
@@ -0,0 +1,73 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qxm5-vx5j-pp6w",
"modified": "2024-04-22T22:57:14Z",
"published": "2022-05-24T17:35:23Z",
"aliases": [
"CVE-2020-27348"
],
"summary": "snapcraft Access Restriction Bypass",
"details": "In some conditions, a snap package built by snapcraft includes the current directory in `LD_LIBRARY_PATH`, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "snapcraft"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.4.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27348"
},
{
"type": "WEB",
"url": "https://github.com/snapcore/snapcraft/pull/3345"
},
{
"type": "WEB",
"url": "https://github.com/snapcore/snapcraft/commit/a0ceca9d531a34c979251030ed67b5fa2abfdd9a"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/bugs/1901572"
},
{
"type": "PACKAGE",
"url": "https://github.com/snapcore/snapcraft"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/usn/usn-4661-1"
}
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:57:14Z",
"nvd_published_at": "2020-12-04T03:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-whmq-cfm5-j8mj/GHSA-whmq-cfm5-j8mj.json → advisories/github-reviewed/2022/05/GHSA-whmq-cfm5-j8mj/GHSA-whmq-cfm5-j8mj.json
+22 -5
View File
@@ -1,17 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-whmq-cfm5-j8mj",
"modified": "2022-05-24T17:42:18Z",
"modified": "2024-04-22T22:57:23Z",
"published": "2022-05-24T17:42:18Z",
"aliases": [
"CVE-2020-25340"
],
"summary": "NFStream Local Denial of Service (DoS)",
"details": "An issue was discovered in NFStream 5.2.0. Because some allocated modules are not correctly freed, if the nfstream object is directly destroyed without being used after it is created, it will cause a memory leak that may result in a local denial of service (DoS).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nfstream"
},
"versions": [
"5.2.0"
]
}
],
"references": [
{
@@ -21,15 +33,20 @@
{
"type": "WEB",
"url": "https://github.com/ntop/nDPI/issues/994"
},
{
"type": "PACKAGE",
"url": "https://github.com/nfstream/nfstream"
}
],
"database_specific": {
"cwe_ids": [
"CWE-401",
"CWE-770"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:57:23Z",
"nvd_published_at": "2021-02-16T15:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-7cwg-2575-3546/GHSA-7cwg-2575-3546.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7cwg-2575-3546",
"modified": "2022-05-13T01:39:57Z",
"published": "2022-05-13T01:39:57Z",
"aliases": [
"CVE-2017-0360"
],
"details": "file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a \"same root name but with a suffix\" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0360"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-security-announce/2017/msg00084.html"
},
{
"type": "WEB",
"url": "http://hg.tryton.org/trytond?cmd=changeset;node=472510fdc6f8"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3826"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97489"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-04T17:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-qxm5-vx5j-pp6w/GHSA-qxm5-vx5j-pp6w.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qxm5-vx5j-pp6w",
"modified": "2022-05-24T17:35:23Z",
"published": "2022-05-24T17:35:23Z",
"aliases": [
"CVE-2020-27348"
],
"details": "In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27348"
},
{
"type": "WEB",
"url": "https://github.com/snapcore/snapcraft/pull/3345"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/bugs/1901572"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/usn/usn-4661-1"
}
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-04T03:15:00Z"
}
}