netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-g2hf-g7fh-vg92
GHSA-vfmm-jm4v-7frq
GHSA-fpx3-h2pc-88vf
GHSA-vfmm-jm4v-7frq
This commit is contained in:
advisory-database[bot]
2025-04-22 22:17:36 +00:00
parent 3634364f97
commit 469476e9d5
4 changed files with 185 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-g2hf-g7fh-vg92/GHSA-g2hf-g7fh-vg92.json → advisories/github-reviewed/2022/05/GHSA-g2hf-g7fh-vg92/GHSA-g2hf-g7fh-vg92.json
+52 -12
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g2hf-g7fh-vg92",
"modified": "2025-04-20T03:44:56Z",
"modified": "2025-04-22T22:15:48Z",
"published": "2022-05-17T00:50:35Z",
"aliases": [
"CVE-2016-8737"
],
"summary": "Apache Brooklyn is vulnerable to cross-site request forgery (CSRF)",
"details": "In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the attacker's commands as the user. There is known to be a proof-of-concept exploit using this vulnerability.",
"severity": [
{
@@ -13,12 +14,59 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.brooklyn:brooklyn-rest-resources"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.0"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.brooklyn:brooklyn-jsgui"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8737"
},
{
"type": "WEB",
"url": "https://github.com/apache/brooklyn-server/pull/430"
},
{
"type": "WEB",
"url": "https://github.com/apache/brooklyn-ui/pull/37"
},
{
"type": "WEB",
"url": "https://brooklyn.apache.org/community/security/CVE-2016-8737.html"
@@ -26,14 +74,6 @@
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/877813aaaa0e636adbc36106b89a54e0e6918f0884e9c8b67d5d5953%40%3Cdev.brooklyn.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/877813aaaa0e636adbc36106b89a54e0e6918f0884e9c8b67d5d5953@%3Cdev.brooklyn.apache.org%3E"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96228"
}
],
"database_specific": {
@@ -41,8 +81,8 @@
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-22T22:15:48Z",
"nvd_published_at": "2017-09-13T16:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-vfmm-jm4v-7frq/GHSA-vfmm-jm4v-7frq.json
+107
View File
@@ -0,0 +1,107 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vfmm-jm4v-7frq",
"modified": "2025-04-22T22:16:01Z",
"published": "2022-05-13T01:27:48Z",
"aliases": [
"CVE-2014-7808"
],
"summary": "Apache Wicket insecure defaults",
"details": "Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.wicket:wicket-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.13"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.wicket:wicket-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.0.0-beta1"
},
{
"fixed": "6.19.0"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.wicket:wicket-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0-M1"
},
{
"fixed": "7.0.0-M5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7808"
},
{
"type": "WEB",
"url": "https://github.com/apache/wicket/commit/d2b8848346b8f806e747dca18799d70c37fc893f"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/wicket"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/rqy6lpo5mzco85cbf65r53vdh87gz77b"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20180830051017/https://www.smrrd.de/cve-2014-7808-apache-wicket-csrf-2014.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-04-22T22:16:01Z",
"nvd_published_at": "2017-09-15T20:29:00Z"
}
}
advisories/unreviewed/2025/04/GHSA-fpx3-h2pc-88vf/GHSA-fpx3-h2pc-88vf.json → advisories/github-reviewed/2025/04/GHSA-fpx3-h2pc-88vf/GHSA-fpx3-h2pc-88vf.json
+26 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fpx3-h2pc-88vf",
"modified": "2025-04-22T21:30:44Z",
"modified": "2025-04-22T22:16:36Z",
"published": "2025-04-22T21:30:44Z",
"aliases": [
"CVE-2025-26159"
],
"summary": "Laravel Starter Cross Site Scripting (XSS)",
"details": "Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field.",
"severity": [
{
@@ -13,14 +14,34 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "nasirkhan/laravel-starter"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "11.11.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26159"
},
{
"type": "WEB",
"type": "PACKAGE",
"url": "https://github.com/nasirkhan/laravel-starter"
},
{
@@ -33,8 +54,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-22T22:16:36Z",
"nvd_published_at": "2025-04-22T20:15:28Z"
}
}
advisories/unreviewed/2022/05/GHSA-vfmm-jm4v-7frq/GHSA-vfmm-jm4v-7frq.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vfmm-jm4v-7frq",
"modified": "2025-04-20T03:45:23Z",
"published": "2022-05-13T01:27:48Z",
"aliases": [
"CVE-2014-7808"
],
"details": "Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7808"
},
{
"type": "WEB",
"url": "https://www.smrrd.de/cve-2014-7808-apache-wicket-csrf-2014.html"
},
{
"type": "WEB",
"url": "http://mail-archives.apache.org/mod_mbox/wicket-users/201502.mbox/%3CCAMomwMpLPDYezc=iFofm1R1Uq37vUFJ8VC-_ex5SU8-HAKBoRw%40mail.gmail.com%3E"
},
{
"type": "WEB",
"url": "http://mail-archives.apache.org/mod_mbox/wicket-users/201502.mbox/%3CCAMomwMpLPDYezc=iFofm1R1Uq37vUFJ8VC-_ex5SU8-HAKBoRw@mail.gmail.com%3E"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-15T20:29:00Z"
}
}