netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-544r-fc65-v832
GHSA-hvxg-77mg-vrvp
GHSA-hw2c-8xgw-mf57
GHSA-xgqm-wp7w-mgg2
This commit is contained in:
advisory-database[bot]
2024-06-17 21:24:17 +00:00
parent 87e983ce68
commit 448176b6d5
4 changed files with 126 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json → advisories/github-reviewed/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json
+36 -6
View File
@@ -1,17 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-544r-fc65-v832",
"modified": "2024-06-14T12:30:50Z",
"modified": "2024-06-17T21:23:04Z",
"published": "2024-06-14T12:30:50Z",
"aliases": [
"CVE-2024-5685"
],
"summary": "Snipe-IT allows users to promote or demote themselves or other users",
"details": "Users with \"User:edit\" and \"Self:api\" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "snipe/snipe-it"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.2"
}
]
}
]
}
],
"references": [
{
@@ -26,6 +52,10 @@
"type": "WEB",
"url": "https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1"
},
{
"type": "PACKAGE",
"url": "https://github.com/snipe/snipe-it"
},
{
"type": "WEB",
"url": "https://github.com/snipe/snipe-it/releases/tag/v6.4.2"
@@ -35,9 +65,9 @@
"cwe_ids": [
"CWE-862"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-06-17T21:23:04Z",
"nvd_published_at": "2024-06-14T10:15:10Z"
}
}
advisories/unreviewed/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json → advisories/github-reviewed/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json
+31 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hvxg-77mg-vrvp",
"modified": "2024-06-14T09:31:17Z",
"modified": "2024-06-17T21:23:17Z",
"published": "2024-06-14T09:31:17Z",
"aliases": [
"CVE-2024-37182"
],
"summary": "Mattermost Desktop App Remote Code Execution",
"details": "Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim's system via custom URI schemes.",
"severity": [
{
@@ -14,13 +15,39 @@
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "mattermost-desktop"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.8.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37182"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/desktop/commit/1c9fc719dc2b74495a05f7ebc90e92e7daa03e6d"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/desktop"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
@@ -31,8 +58,8 @@
"CWE-693"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-06-17T21:23:17Z",
"nvd_published_at": "2024-06-14T09:15:10Z"
}
}
advisories/unreviewed/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json → advisories/github-reviewed/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json
+32 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hw2c-8xgw-mf57",
"modified": "2024-06-16T15:30:44Z",
"modified": "2024-06-17T21:22:07Z",
"published": "2024-06-16T15:30:44Z",
"aliases": [
"CVE-2024-38460"
],
"summary": "SonarQube logs sensitive information",
"details": "In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).",
"severity": [
{
@@ -14,17 +15,43 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.sonarsource.sonarqube:sonar-web"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.9.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38460"
},
{
"type": "WEB",
"url": "https://github.com/SonarSource/sonarqube/commit/48f43d6a3bf9bbd7c9b58eb5cde635572184ad01"
},
{
"type": "WEB",
"url": "https://community.sonarsource.com/t/sonarqube-ce-10-3-0-leaking-encrypted-values-in-web-server-logs/108187"
},
{
"type": "PACKAGE",
"url": "https://github.com/SonarSource/sonarqube"
},
{
"type": "WEB",
"url": "https://sonarsource.atlassian.net/browse/SONAR-21559"
@@ -32,11 +59,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-06-17T21:22:06Z",
"nvd_published_at": "2024-06-16T15:15:51Z"
}
}
advisories/unreviewed/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json → advisories/github-reviewed/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xgqm-wp7w-mgg2",
"modified": "2024-06-14T09:31:17Z",
"modified": "2024-06-17T21:23:49Z",
"published": "2024-06-14T09:31:17Z",
"aliases": [
"CVE-2024-36287"
],
"summary": "Mattermost Desktop App allows for bypassing TCC restrictions on macOS",
"details": "Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "mattermost-desktop"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.8.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36287"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/desktop"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
@@ -31,8 +54,8 @@
"CWE-693"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-06-17T21:23:49Z",
"nvd_published_at": "2024-06-14T09:15:09Z"
}
}