Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-02 05:17:58 +00:00
parent ddef80ff2a
commit 43c3bb1281
847 changed files with 1650 additions and 4950 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "Layout XML Arbitrary Code Fix ",
  "details": "### Impact\nLayout XML enabled admin users to execute arbitrary commands via block methods.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Data Flow Sanitation Issue Fix ",
  "details": "### Impact\nDue to missing sanitation in data flow it was possible for admin users to upload arbitrary executable files to the server.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-2c83-wfv3-q25f",
  "modified": "2021-09-07T14:04:47Z",
  "published": "2021-09-07T23:07:56Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdown",
  "details": "### Impact\n\nA Remote Command Execution vulnerability was found in the rebber module,\nwhich allowed execution of arbitrary commands. The reported problem came\nfrom CodeBlocks, which could be escaped to insert malicious LaTeX.\n\nAnyone using `rebber` without sanitation of code content or a custom\nmacro is impacted by this vulnerability. Here is an example of a Markdown\ncontent that will exploit the vulnerability:\n\n````markdown\n```\n\\end{CodeBlock}\n\n\\immediate\\write18{COMMAND > outputrce}\n\\input{outputrce}\n\n\\begin{CodeBlock}{text}\n```\n````\n\nWill insert into the generated LaTeX the result of executing\n`COMMAND` on the system.\n\n### Patches\n\nThe vulnerability has been patched in version 5.2.1.\nIf impacted, you should update to this version as soon as possible.\n\n### Workarounds\n\nIt is possible to mitigate the vulnerability without upgrading by using a\ncustom code macro. Please make sure this custom macro escapes your\nclosing LaTeX sequence. For the example above, use:\n\n```javascript\nconst escaped = content.replace(new RegExp('\\\\\\\\end\\\\s*{CodeBlock}', 'g'), '')\n```\n\n### For more information\n\nIf you have any questions or comments about this advisory, open an issue in [ZMarkdown](https://github.com/zestedesavoir/zmarkdown/issues).",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-2rh5-jvgx-pgw3",
  "modified": "2021-09-14T18:35:38Z",
  "published": "2021-09-14T20:25:13Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Any storage file can be downloaded from p.sh if full server path is known",
  "details": "The default configuration for platform.sh (.platform.app.yaml) allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge, the default configuration also allows access to certain legacy files that should not be readable, including the legacy var directory and extension directories.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-36mj-6r7r-mqhf",
  "modified": "2021-09-28T21:21:08Z",
  "published": "2021-09-29T17:09:23Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "User can obtain JWT token even if account is disabled",
  "details": "Users can authenticate this way even if their user account is disabled. This is a high risk vulnerability when account disabling is used to block users' access to the system. (Someone who never had an account cannot exploit this vulnerability.) The fix ensures tokens are generated only for enabled user accounts, and is distributed via Composer as ezsystems/ezplatform-rest v1.3.8",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-593v-wcqx-hq2w",
  "modified": "2021-09-03T21:34:00Z",
  "published": "2021-09-07T22:57:58Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Incorrect version tags linked to external repository",
  "details": "### Impact\nA security incident caused a number of incorrect version tags to be pushed to the Parse Server repository. These version tags linked to a personal fork of a contributor who had write access to the repository. The code to which these tags linked has not been reviewed or approved by Parse Platform. Even though no releases were published with these incorrect versions, it was possible to define a Parse Server dependency that pointed to these version tags, for example if you defined this dependency: \n```js\n\"parse-server\": \"git@github.com:parse-community/parse-server.git#4.9.3\"\n```\n\nWe have since deleted the incorrect version tags, but they may still show up in your personal fork on GitHub or locally. We do not know when these tags have been pushed to the Parse Server repository, but we first became aware of this issue on July 21, 2021. We are not aware of any malicious code or concerns related to privacy, security or legality (e.g. proprietary code). However, it has been reported that some functionality does not work as expected and the introduction of security vulnerabilities cannot be ruled out.\n\nYou may be also affected if you used the Bitnami image for Parse Server. Bitnami picked up the incorrect version tag `4.9.3` and published a new Bitnami image for Parse Server. \n \n**If you are using any of the affected versions, we urgently recommend to upgrade to version `4.10.0`.**\n\n\nThese are the incorrect tags:\n```\n4.0.0-beta1\n4.0.0-beta2\n4.0.0-beta3\n4.0.0-beta4\n4.0.0-beta5\n4.0.0-beta6\n4.0.10\n4.0.11\n4.0.12\n4.0.13\n4.0.14\n4.0.3\n4.0.4\n4.0.6\n4.0.7\n4.0.8\n4.0.9\n4.6.0\n4.6.0-beta\n4.7.0\n4.8.0\n4.8.1\n4.8.2\n4.8.3\n4.8.4\n4.8.5\n4.9.0\n4.9.1\n4.9.2\n4.9.3\n```\n\n### Patches\nUpgrade to version `4.10.0`.\n\n### Workarounds\nDowngrade to version `4.5.2`.\n\n### References\nn/a",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -62,9 +58,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-09-03T21:34:00Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-65p7-pjj8-ggmr",
  "modified": "2021-09-23T21:14:22Z",
  "published": "2021-09-23T23:18:42Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Member account takeover",
  "details": "### Impact\n\nAn error in the implementation of the member email change functionality allows unauthenticated users to change the email address of arbitrary member accounts to one they control by crafting a request to the relevant API endpoint, and validating the new address via magic link sent to the new email address.\n\nGhost(Pro) has already been patched. Self-hosters are impacted if running Ghost a version between 3.18.0 and 4.15.0 with members functionality enabled.\n\n### Patches\n\nFixed in 4.15.1, all 4.x sites should upgrade as soon as possible.\nFixed in 3.42.6, all 3.x sites should upgrade as soon as possible.\n\n### Workarounds\n\nThe patch in 4.15.1 and 3.42.6 adds a new authenticated endpoint for updating member email addresses. Updating Ghost is the quickest complete solution.\n\nAs a workaround, if for any reason you cannot update your Ghost instance, you can block the `POST /members/api/send-magic-link/` endpoint, which will also disable member login and signup for your site.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Email us at [security@ghost.org](mailto:security@ghost.org)\n",
  "severity": [
@@ -65,9 +63,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2021-09-23T21:14:22Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Server-Side Request Forgery in UReport",
  "details": "UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "XML External Entity Reference in Apache Jena",
  "details": "A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-84p7-fh9c-6g8h",
  "modified": "2021-09-16T21:30:18Z",
  "published": "2021-09-20T19:52:24Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Prototype Pollution in mixme",
  "details": "### Impact\nWhen copying properties from a source object to a target object, the target object can gain access to certain properties of the source object and modify their content.\n\n### Patches\nThe problem was patch with a more agressive discovery of secured properties to filter out.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-8r4g-cg4m-x23c",
  "modified": "2021-12-20T22:16:43Z",
  "published": "2021-09-22T18:22:02Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Denial of Service in node-static",
  "details": "All versions of node-static are vulnerable to a Denial of Service. The package fails to catch an exception when user input includes null bytes. This allows attackers to access `http://host/%00` and crash the server.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -54,9 +54,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-09-13T19:31:57Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Cross-site Scripting in the femanager TYPO3 extension",
  "details": "The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website.\n\nNote: If SVG uploads are required, it is recommended to use the TYPO3 extension svg_sanitizer (added to TYPO3 core since versions 9.5.28, 10.4.18 and 11.3.0) to prevent upload of malicious SVG files or to set up a strict Content Security Policy for the destination folder of uploaded images.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-gqcf-83rq-gpfr",
  "modified": "2021-09-14T18:35:35Z",
  "published": "2021-09-14T20:24:44Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Any storage file can be downloaded from p.sh if full server path is known",
  "details": "The default configuration for platform.sh (.platform.app.yaml) allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge, the default configuration also allows access to certain legacy files that should not be readable, including the legacy var directory and extension directories.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-jpwx-ffjq-wr4w",
  "modified": "2021-09-03T20:10:38Z",
  "published": "2021-09-07T22:54:23Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Content object state fetch functions open to SQL injection",
  "details": "### Impact\nThis Security Update is about a vulnerability in eZ Publish Legacy. The content object state code could be vulnerable to SQL injection. There is no known exploit, but one might be possible. If you use Legacy in any way, we strongly recommend that you install this update as soon as possible.\n\n### Patches\nThe fix is distributed via Composer, see \"Patched versions\".\n\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-m489-xr35-fjxr",
  "modified": "2021-09-22T20:34:42Z",
  "published": "2021-09-22T20:35:08Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Regular Expression Denial of Service in millisecond",
  "details": "Versions of `millisecond` prior to 0.1.2 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.\n\n\n## Proof of concept\n```\nvar ms = require('millisecond');\nvar genstr = function (len, chr) {\n   var result = \"\";\n   for (i=0; i<=len; i++) {\n       result = result + chr;\n   }\n\n   return result;\n}\n\nms(genstr(process.argv[2], \"5\") + \" minutea\");\n```\n\n\n## Recommendation\n\nUpdate to version 0.1.2 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-q4h9-46xg-m3x9",
  "modified": "2021-09-14T22:17:40Z",
  "published": "2021-09-15T20:22:13Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable",
  "details": "### Impact\n\nUpgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon.\n\n### Patches\n\nA fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.\n\n### Workarounds\n\nInitialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).\n\n### References\n\nA post-mortem will be published in a few days in the [OpenZeppelin Forum](https://forum.openzeppelin.com/).\n\n### For more information\n\nIf you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -43,9 +39,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-09-14T22:17:40Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Arbitrary Code Execution in feehi/cms",
  "details": "An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -54,9 +54,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-08T22:09:39Z",
@@ -50,9 +50,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-08T22:15:48Z",
--- a/Show More
+++ b/Show More