Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-03 05:09:45 +00:00
parent 6319fe2cb4
commit 4b7eda0592
960 changed files with 1425 additions and 4275 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "Cross-site scripting vulnerability in TinyMCE",
  "details": "### Impact\nA cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs. This impacts all users who are using TinyMCE 5.5.1 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 5.6.0 by improved URL sanitization logic.\n\n### Workarounds\nTo work around this vulnerability, either:\n- Upgrade to TinyMCE 5.6.0 or higher\n- Manually sanitize `iframe`, `object` and `embed` URL attributes using a [TinyMCE node filter](https://www.tiny.cloud/docs/api/tinymce.html/tinymce.html.domparser/#addnodefilter).\n- Disable `iframe`, `object`, and `embed` elements in your content using the [invalid_elements](https://www.tiny.cloud/docs/configure/content-filtering/#invalid_elements) setting.\n\n#### Example: Sanitizing using a node filter\n```js\neditor.parser.addNodeFilter('iframe,object,embed', function(nodes) {\n  nodes.forEach(function(node) {\n    if (node.attributes) {\n      node.attributes.forEach(function(attr) {\n        var name = attr.name;\n        var value = attr.value;\n        // Sanitize the attribute value here or remove it entirely\n        var sanitizedValue = ...;\n        node.attr(name, santizedValue);\n      });\n    }\n  });\n});\n```\n\n#### Example: Using invalid_elements\n```js\ninvalid_elements: 'iframe,object,embed'\n```\n\n### Acknowledgements\nTiny Technologies would like to thank Aaron Bishop at SecurityMetrics for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Denial of service in CBOR library",
  "details": "### Impact\nDue to this library's use of an inefficient algorithm, it is vulnerable to a denial of service attack when a maliciously crafted input is passed to `DecodeFromBytes` or other CBOR decoding mechanisms in this library.\n\nAffected versions _include_ versions 4.0.0 through 4.5.0.\n\nThis vulnerability was privately reported to me.\n\n### Patches\nThis issue has been fixed in version 4.5.1.  Users should use the latest version of this library. (The latest version is not necessarily 4.5.1.  Check the [NuGet page](https://www.nuget.org/packages/PeterO.Cbor) to see the latest version's version number.)\n\n### Workarounds\n\nAgain, users should use the latest version of this library.\n\nIn the meantime, note that the inputs affected by this issue are all CBOR maps or contain CBOR maps.  An input that decodes to a single CBOR object is not capable of containing a CBOR map if&mdash;\n\n- it begins with a byte other than 0x80 through 0xDF, or\n- it does not contain a byte in the range 0xa0 through 0xBF.\n\nSuch an input is not affected by this vulnerability and an application can choose to perform this check before passing it to a CBOR decoding mechanism.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the CBOR repository](https://github.com/peteroupc/CBOR).\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-52rh-5rpj-c3w6",
  "modified": "2022-05-05T16:00:50Z",
  "published": "2022-05-05T16:00:50Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Improper handling of multiline messages in node-irc",
  "details": "node-irc is a socket wrapper for the IRC protocol that extends Node.js' EventEmitter. The vulnerability allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. Incorrect handling of a CR character allowed for making part of the message be sent to the IRC server verbatim rather than as a message to the channel.\nThe vulnerability has been patched in node-irc version 1.2.1.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -58,9 +54,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-05-05T16:00:50Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "OpenStack Keystone allows context-dependent attackers to bypass access restrictions",
  "details": "OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-3qwc-47jf-5rf7",
  "modified": "2024-03-05T14:39:13Z",
  "published": "2024-03-05T14:39:13Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "eth-abi is vulnerable to recursive DoS",
  "details": "This is related to recent ZST stuff (https://github.com/ethereum/eth-abi/security/advisories/GHSA-rqr8-pxh7-cq3g), but it's a different one. Basically a recursive pointer issue\n\n```py\nfrom eth_abi import decode\n\n\npayload = \"0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020\"\n\n# OverflowError: Python int too large to convert to C ssize_t\n#decode(['(uint256[][][][][][][][][][])'], bytearray.fromhex(payload))\n\ndecode(['uint256[][][][][][][][][][]'], bytearray.fromhex(payload+('00' * 1024)))\n```",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -50,9 +46,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-05T14:39:13Z",
@@ -54,9 +54,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-12T23:01:23Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-7jjx-3qw9-j6h6",
  "modified": "2024-11-12T20:53:00Z",
  "published": "2024-11-12T20:53:00Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "cggmp21-keygen has ambiguous challenge derivation",
  "details": "Challenge derivation in non-interactive ZK proofs was ambiguous and that could lead to security vulnerability (however, it's unknown if it could be exploited).\n",
  "severity": [
@@ -4,9 +4,7 @@
  "modified": "2024-11-12T23:01:43Z",
  "published": "2024-11-12T18:30:58Z",
  "withdrawn": "2024-11-12T23:01:43Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: .NET and Visual Studio Remote Code Execution Vulnerability",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6x36-qxmj-rv4p. This link is maintained to preserve external references.\n\n## Original Description\n.NET and Visual Studio Remote Code Execution Vulnerability",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-fpr5-jp2j-4q2f",
  "modified": "2024-11-12T21:20:26Z",
  "published": "2024-11-12T21:20:26Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "paillier-zk has ambiguous challenge derivation",
  "details": "Challenge derivation in non-interactive ZK proofs was ambiguous and that could lead to security vulnerability (however, it's unknown if it could be exploited).\n",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-g23h-7vf9-xc25",
  "modified": "2024-11-12T21:21:36Z",
  "published": "2024-11-12T21:21:36Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Mimalloc Can Allocate Memory with Bad Alignment",
  "details": "This crate depended on a promise regarding alignments made by the author of the mimalloc allocator to avoid using aligned allocation functions where possible for performance reasons.\nSince then, the mimalloc allocator's logic changed, making it break this promise.\nThis caused this crate to return memory with an incorrect alignment for some allocations, particularly those with large alignments.\nThe flaw was fixed by always using the aligned allocation functions.\n",
  "severity": [
@@ -50,9 +48,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-12T21:21:36Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-pqpw-89w5-82v5",
  "modified": "2024-11-12T20:53:55Z",
  "published": "2024-11-12T20:53:54Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "`simd-json-derive` vulnerable to `MaybeUninit` misuse",
  "details": "An invalid use of `MaybeUninit::uninit().assume_init()` in `simd-json-derive`'s derive macro can cause undefined behavior. The original code used `MaybeUninit` to avoid initialisation of the struct and then set the fields using `ptr::write`. The undefined behavior triggered by this misuse of `MaybeUninit` can lead to invlaid memory access and panics in binaries compiled in release mode (aka simd-json-derive prior to version 0.12 has UB and optimizes into some nonsense)\n\nThe version `0.12.0` removes this section of code, avoiding the use of MaybeUninit alltogether.\n",
  "severity": [
@@ -50,9 +48,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-12T20:53:54Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-rm66-9gh4-4gp8",
  "modified": "2024-11-12T20:54:58Z",
  "published": "2024-11-12T20:54:58Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "cggmp21 vulnerable to ambiguous challenge derivation",
  "details": "Challenge derivation in non-interactive ZK proofs was ambiguous and that could lead to security vulnerability (however, it's unknown if it could be exploited).\n",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-x8jh-xj3x-gx3c",
  "modified": "2024-11-12T20:48:39Z",
  "published": "2024-11-12T20:48:39Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "`fast-float` has multiple soundness issues",
  "details": "`fast-float` contains multiple soundness issues:\n\n 1. [Undefined behavior when checking input length](https://github.com/aldanor/fast-float-rust/issues/28), which has been merged but no package [pubished](https://github.com/aldanor/fast-float-rust/issues/35).\n 1. [Many functions marked as safe with non-local safety guarantees](https://github.com/aldanor/fast-float-rust/issues/37)\n\nThe library is also unmaintained.\n\n## Alternatives\n\nFor quickly parsing floating-point numbers third-party crates are generally no longer needed. A fast float parsing algorithm by the author of `lexical` has been [merged](https://github.com/rust-lang/rust/pull/86761) into libcore. When requiring direct parsing from bytes and/or partial parsers, the [`fast-float2`](https://crates.io/crates/fast-float2) fork of `fast-float` containing these security patches and reduces overall usage of unsafe.\n",
  "severity": [
@@ -58,9 +56,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-12T20:48:39Z",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2013-0447"
  ],
  "details": "Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -40,9 +36,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -7,12 +7,8 @@
    "CVE-2013-0381"
  ],
  "details": "Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Application Framework.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -36,9 +32,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2013-0520"
  ],
  "details": "IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 allows remote authenticated users to obtain sensitive Java stack-trace information by providing invalid input data.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2013-0426"
  ],
  "details": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0428.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect \"access control checks\" in the logging API that allow remote attackers to bypass Java sandbox restrictions.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -128,9 +124,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
--- a/Show More
+++ b/Show More