netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-fqcg-3mm9-jcr6
GHSA-wcfw-xf28-g8pv
GHSA-q8xm-x824-w6gf
GHSA-59xx-49pj-8gx8
GHSA-hfmf-v8jm-fcm9
GHSA-j7rp-c5hp-xpqv
GHSA-jj65-jvhx-4h6p
GHSA-mh5g-qxxq-3x3p
GHSA-p8x9-vqx9-g5pw
GHSA-pg27-6936-jg2x
GHSA-pj8j-q75x-3c3f
GHSA-pmfq-rg8w-w57m
GHSA-q84w-4cfg-vvhh
GHSA-v755-r9fp-w5gj
GHSA-x6vf-7crv-fr5w
GHSA-xmv6-x39j-72gg
This commit is contained in:
advisory-database[bot]
2024-11-26 00:34:22 +00:00
parent 7560f80ca6
commit 4dcce2eda7
16 changed files with 592 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/02/GHSA-fqcg-3mm9-jcr6/GHSA-fqcg-3mm9-jcr6.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fqcg-3mm9-jcr6",
"modified": "2024-02-29T03:33:13Z",
"modified": "2024-11-26T00:33:28Z",
"published": "2024-02-29T03:33:13Z",
"aliases": [
"CVE-2023-43769"
],
"details": "An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. There are Unauthenticated RMI Service Ports Exposed in Analytics.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
@@ -39,7 +42,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T01:41:09Z"
advisories/unreviewed/2024/06/GHSA-wcfw-xf28-g8pv/GHSA-wcfw-xf28-g8pv.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wcfw-xf28-g8pv",
"modified": "2024-06-13T21:30:52Z",
"modified": "2024-11-26T00:33:31Z",
"published": "2024-06-13T21:30:52Z",
"aliases": [
"CVE-2024-36589"
],
"details": "An issue in Annonshop.app DecentralizeJustice/anonymousLocker commit 2b2b4 to ba9fd and DecentralizeJustice/anonBackend commit 57837 to cd815 was discovered to store credentials in plaintext.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-13T19:15:52Z"
advisories/unreviewed/2024/10/GHSA-q8xm-x824-w6gf/GHSA-q8xm-x824-w6gf.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q8xm-x824-w6gf",
"modified": "2024-10-07T21:33:30Z",
"modified": "2024-11-26T00:33:31Z",
"published": "2024-10-07T21:33:30Z",
"aliases": [
"CVE-2024-45894"
],
"details": "BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-07T19:15:09Z"
advisories/unreviewed/2024/11/GHSA-59xx-49pj-8gx8/GHSA-59xx-49pj-8gx8.json
+47
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2024/11/GHSA-hfmf-v8jm-fcm9/GHSA-hfmf-v8jm-fcm9.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hfmf-v8jm-fcm9",
"modified": "2024-11-26T00:33:31Z",
"published": "2024-11-26T00:33:31Z",
"aliases": [
"CVE-2024-53597"
],
"details": "masterstack_imgcap v0.0.1 was discovered to contain a SQL injection vulnerability via the endpoint /submit.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53597"
},
{
"type": "WEB",
"url": "https://github.com/NoPurposeInLife/vulnerability_research/tree/main/CVE-2024-53597"
},
{
"type": "WEB",
"url": "http://masterstackimgcap.com"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-25T22:15:19Z"
}
}
advisories/unreviewed/2024/11/GHSA-j7rp-c5hp-xpqv/GHSA-j7rp-c5hp-xpqv.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j7rp-c5hp-xpqv",
"modified": "2024-11-26T00:33:31Z",
"published": "2024-11-26T00:33:31Z",
"aliases": [
"CVE-2024-53098"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/ufence: Prefetch ufence addr to catch bogus address\n\naccess_ok() only checks for addr overflow so also try to read the addr\nto catch invalid addr sent from userspace.\n\n(cherry picked from commit 9408c4508483ffc60811e910a93d6425b8e63928)",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53098"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5d623ffbae96b23f1fc43a3d5a267aabdb07583d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9c1813b3253480b30604c680026c7dc721ce86d1"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-25T22:15:16Z"
}
}
advisories/unreviewed/2024/11/GHSA-jj65-jvhx-4h6p/GHSA-jj65-jvhx-4h6p.json
+63
View File
@@ -0,0 +1,63 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jj65-jvhx-4h6p",
"modified": "2024-11-26T00:33:31Z",
"published": "2024-11-26T00:33:31Z",
"aliases": [
"CVE-2024-53101"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Fix uninitialized value issue in from_kuid and from_kgid\n\nocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in\na trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set.\n\nInitialize all fields of newattrs to avoid uninitialized variables, by\nchecking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53101"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/15f34347481648a567db67fb473c23befb796af5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/17ecb40c5cc7755a321fb6148cba5797431ee5b8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1c28bca1256aecece6e94b26b85cd07e08b0dc90"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1cb5bfc5bfc651982b6203c224d49b7ddacf28bc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5a72b0d3497b818d8f000c347a7c11801eb27bfc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9db25c2b41c34963c3ccf473b08171f87670652e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a0c77e5e3dcbffc7c6080ccc89c037f0c86496cf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b3e612bd8f64ce62e731e95f635e06a2efe3c80c"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-25T22:15:17Z"
}
}
advisories/unreviewed/2024/11/GHSA-mh5g-qxxq-3x3p/GHSA-mh5g-qxxq-3x3p.json
+47
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2024/11/GHSA-p8x9-vqx9-g5pw/GHSA-p8x9-vqx9-g5pw.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p8x9-vqx9-g5pw",
"modified": "2024-11-20T21:30:50Z",
"modified": "2024-11-26T00:33:31Z",
"published": "2024-11-20T21:30:50Z",
"aliases": [
"CVE-2024-48984"
],
"details": "An issue was discovered in MBed OS 6.16.0. When parsing hci reports, the hci parsing software dynamically determines the length of a list of reports by reading a byte from an input stream. It then fetches the length of the first report, uses it to calculate the beginning of the second report, etc. In doing this, it tracks the largest report so it can later allocate a buffer that fits every individual report (but only one at a time). It does not, however, validate that these addresses are all contained within the buffer passed to hciEvtProcessLeExtAdvReport. It is then possible, though unlikely, that the buffer designated to hold the reports is allocated in such a way that one of these out-of-bounds length fields is contained within the new buffer. When the (n-1)th report is copied, it overwrites the length field of the nth report. This now corrupted length field is then used for a memcpy into the new buffer, which may lead to a buffer overflow.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-120"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-20T21:15:07Z"
advisories/unreviewed/2024/11/GHSA-pg27-6936-jg2x/GHSA-pg27-6936-jg2x.json
+59
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2024/11/GHSA-pj8j-q75x-3c3f/GHSA-pj8j-q75x-3c3f.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pj8j-q75x-3c3f",
"modified": "2024-11-26T00:33:31Z",
"published": "2024-11-26T00:33:31Z",
"aliases": [
"CVE-2024-53333"
],
"details": "TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function. This vulnerability allows an attacker to execute arbitrary commands via the \"ussd\" parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53333"
},
{
"type": "WEB",
"url": "https://github.com/luckysmallbird/Totolink-EX200-Vulnerability-1/blob/main/README.md"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-21T18:15:13Z"
}
}
advisories/unreviewed/2024/11/GHSA-pmfq-rg8w-w57m/GHSA-pmfq-rg8w-w57m.json
+35
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2024/11/GHSA-q84w-4cfg-vvhh/GHSA-q84w-4cfg-vvhh.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q84w-4cfg-vvhh",
"modified": "2024-11-26T00:33:31Z",
"published": "2024-11-26T00:33:31Z",
"aliases": [
"CVE-2024-53554"
],
"details": "A Client-Side Template Injection (CSTI) vulnerability in the component /project/new/scrum of Taiga v 8.6.1 allows remote attackers to execute arbitrary code by injecting a malicious payload within the new project details.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53554"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1v2MLZn4Ro9TCpw-KtksUACYFIzsbuTkL/view?usp=sharing"
},
{
"type": "WEB",
"url": "https://gist.githubusercontent.com/Tommywarren/5ed67ab173ed60faeb791215d68e3fac/raw/352cb4259c0d41d70a206d108b5578c15824b2ff/CVE-2024-53554"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-25T22:15:18Z"
}
}
advisories/unreviewed/2024/11/GHSA-v755-r9fp-w5gj/GHSA-v755-r9fp-w5gj.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v755-r9fp-w5gj",
"modified": "2024-11-26T00:33:32Z",
"published": "2024-11-26T00:33:31Z",
"aliases": [
"CVE-2024-11673"
],
"details": "A vulnerability, which was classified as problematic, has been found in 1000 Projects Bookstore Management System 1.0. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11673"
},
{
"type": "WEB",
"url": "https://github.com/Hacker0xone/CVE/issues/16"
},
{
"type": "WEB",
"url": "https://1000projects.org"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.286013"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.286013"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.448470"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-25T23:15:04Z"
}
}
advisories/unreviewed/2024/11/GHSA-x6vf-7crv-fr5w/GHSA-x6vf-7crv-fr5w.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x6vf-7crv-fr5w",
"modified": "2024-11-26T00:33:31Z",
"published": "2024-11-26T00:33:31Z",
"aliases": [
"CVE-2024-11674"
],
"details": "A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an unknown function of the file /backend/doc/his_doc_update-account.php. The manipulation of the argument doc_dpic leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11674"
},
{
"type": "WEB",
"url": "https://codeastro.com"
},
{
"type": "WEB",
"url": "https://github.com/EmilGallajov/zero-day/blob/main/codeastro_hms_rce.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.286014"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.286014"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.448705"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T00:15:04Z"
}
}
advisories/unreviewed/2024/11/GHSA-xmv6-x39j-72gg/GHSA-xmv6-x39j-72gg.json
+43
View File
@@ -0,0 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xmv6-x39j-72gg",
"modified": "2024-11-26T00:33:31Z",
"published": "2024-11-26T00:33:31Z",
"aliases": [
"CVE-2024-53099"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check validity of link->type in bpf_link_show_fdinfo()\n\nIf a newly-added link type doesn't invoke BPF_LINK_TYPE(), accessing\nbpf_link_type_strs[link->type] may result in an out-of-bounds access.\n\nTo spot such missed invocations early in the future, checking the\nvalidity of link->type in bpf_link_show_fdinfo() and emitting a warning\nwhen such invocations are missed.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53099"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8421d4c8762bd022cb491f2f0f7019ef51b4f0a7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b3eb1b6a9f745d6941b345f0fae014dc8bb06d36"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d5092b0a1aaf35d77ebd8d33384d7930bec5cb5d"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-25T22:15:16Z"
}
}