netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2c7w-v459-cwgf
GHSA-98j2-hfxp-8h8r
GHSA-h2rr-m97p-6jq9
GHSA-wpvx-26f7-65q3
GHSA-5m6v-2xgf-qhrw
GHSA-9w2p-rh8c-v9g5
GHSA-v5f6-hjmf-9mc5
GHSA-h2rr-m97p-6jq9
This commit is contained in:
advisory-database[bot]
2024-11-22 20:23:12 +00:00
parent fd54320b7e
commit 4ecbdd20cf
8 changed files with 232 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/03/GHSA-2c7w-v459-cwgf/GHSA-2c7w-v459-cwgf.json → advisories/github-reviewed/2022/03/GHSA-2c7w-v459-cwgf/GHSA-2c7w-v459-cwgf.json
+35 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2c7w-v459-cwgf",
"modified": "2022-04-01T00:00:55Z",
"modified": "2024-11-22T20:20:55Z",
"published": "2022-03-25T00:00:33Z",
"aliases": [
"CVE-2022-25568"
],
"summary": "MotionEye allows attackers to access sensitive information",
"details": "MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "motioneye"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.43.1b1"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +44,18 @@
"type": "WEB",
"url": "https://github.com/ccrisan/motioneye/issues/2292"
},
{
"type": "WEB",
"url": "https://github.com/motioneye-project/motioneye/commit/c60b64af5bb8c09189071522a1f6796cb44340b0"
},
{
"type": "PACKAGE",
"url": "https://github.com/motioneye-project/motioneye"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/motioneye/PYSEC-2022-43141.yaml"
},
{
"type": "WEB",
"url": "https://www.pizzapower.me/2022/02/17/motioneye-config-info-disclosure"
@@ -35,8 +66,8 @@
"CWE-200"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-11-22T20:20:55Z",
"nvd_published_at": "2022-03-24T17:15:00Z"
}
}
advisories/unreviewed/2022/04/GHSA-98j2-hfxp-8h8r/GHSA-98j2-hfxp-8h8r.json → advisories/github-reviewed/2022/04/GHSA-98j2-hfxp-8h8r/GHSA-98j2-hfxp-8h8r.json
+31 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-98j2-hfxp-8h8r",
"modified": "2022-05-07T00:01:11Z",
"modified": "2024-11-22T20:22:34Z",
"published": "2022-04-27T00:00:20Z",
"aliases": [
"CVE-2022-23942"
],
"summary": "Apache Doris hardcoded key and IV",
"details": "Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.",
"severity": [
{
@@ -14,13 +15,39 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pydoris"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23942"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/doris"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pydoris/PYSEC-2022-43150.yaml"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/com2dyzp3bn2rdrotry90q2zzord4tvt"
@@ -39,8 +66,8 @@
"CWE-798"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-11-22T20:22:34Z",
"nvd_published_at": "2022-04-26T16:15:00Z"
}
}
advisories/github-reviewed/2022/04/GHSA-h2rr-m97p-6jq9/GHSA-h2rr-m97p-6jq9.json
+92
View File
@@ -0,0 +1,92 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h2rr-m97p-6jq9",
"modified": "2024-11-22T20:22:09Z",
"published": "2022-04-20T00:00:34Z",
"aliases": [
"CVE-2022-28108"
],
"summary": "Selenium Server (Grid) CSRF",
"details": "Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.seleniumhq.selenium:selenium-grid"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.0"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.seleniumhq.selenium:selenium-server"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28108"
},
{
"type": "PACKAGE",
"url": "https://github.com/SeleniumHQ/selenium"
},
{
"type": "WEB",
"url": "https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2022/02/07/3"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2022/04/14/2"
},
{
"type": "WEB",
"url": "https://www.selenium.dev/downloads"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-11-22T20:22:09Z",
"nvd_published_at": "2022-04-19T03:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-wpvx-26f7-65q3/GHSA-wpvx-26f7-65q3.json → advisories/github-reviewed/2022/05/GHSA-wpvx-26f7-65q3/GHSA-wpvx-26f7-65q3.json
+33 -10
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wpvx-26f7-65q3",
"modified": "2022-05-17T04:41:54Z",
"modified": "2024-11-22T20:21:10Z",
"published": "2022-05-17T04:41:54Z",
"aliases": [
"CVE-2014-3840"
],
"summary": "Mayan EDMS multiple cross-site scripting (XSS) vulnerabilities",
"details": "Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a (1) tag or the (2) title of a source in a Staging folder, (3) Name field in a bootstrap setup, or Title field in a (4) smart link or (5) web form.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mayan-edms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
]
}
],
"references": [
{
@@ -26,6 +45,14 @@
"type": "WEB",
"url": "https://github.com/mayan-edms/mayan-edms/commit/398c480c10416d76e7c1dcb607e726e8fc988e72"
},
{
"type": "PACKAGE",
"url": "https://github.com/mayan-edms/Mayan-EDMS"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/mayan-edms/PYSEC-2014-110.yaml"
},
{
"type": "WEB",
"url": "http://research.openflare.org/advisories/OF-2014-09/mayan-edbs-storedxss.txt"
@@ -45,19 +72,15 @@
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/33493"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/67552"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-11-22T20:21:10Z",
"nvd_published_at": "2014-05-27T13:55:00Z"
}
}
advisories/unreviewed/2023/02/GHSA-5m6v-2xgf-qhrw/GHSA-5m6v-2xgf-qhrw.json → advisories/github-reviewed/2023/02/GHSA-5m6v-2xgf-qhrw/GHSA-5m6v-2xgf-qhrw.json
+31 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5m6v-2xgf-qhrw",
"modified": "2023-02-15T21:30:30Z",
"modified": "2024-11-22T20:21:19Z",
"published": "2023-02-08T00:30:34Z",
"aliases": [
"CVE-2022-47419"
],
"summary": "Mayan EDMS DMS XSS vulnerability",
"details": "An XSS vulnerability was discovered in the Mayan EDMS DMS. Successful XSS exploitation was observed in the in-product tagging system.",
"severity": [
{
@@ -14,13 +15,39 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mayan-edms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.6"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47419"
},
{
"type": "PACKAGE",
"url": "https://github.com/mayan-edms/Mayan-EDMS"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/mayan-edms/PYSEC-2023-276.yaml"
},
{
"type": "WEB",
"url": "https://www.mayan-edms.com/news/2023/02/version-4.3.6"
@@ -35,8 +62,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-11-22T20:21:19Z",
"nvd_published_at": "2023-02-07T22:15:00Z"
}
}
advisories/github-reviewed/2023/12/GHSA-9w2p-rh8c-v9g5/GHSA-9w2p-rh8c-v9g5.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9w2p-rh8c-v9g5",
"modified": "2023-12-11T17:51:02Z",
"modified": "2024-11-22T20:21:21Z",
"published": "2023-12-09T00:39:46Z",
"aliases": [
"CVE-2023-49797"
@@ -52,6 +52,10 @@
"type": "PACKAGE",
"url": "https://github.com/pyinstaller/pyinstaller"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyinstaller/PYSEC-2023-292.yaml"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/blob/0fb18b02c8ad56299d6a2910be0bab8ad601ef24/Lib/shutil.py#L623"
advisories/github-reviewed/2023/12/GHSA-v5f6-hjmf-9mc5/GHSA-v5f6-hjmf-9mc5.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v5f6-hjmf-9mc5",
"modified": "2023-12-05T23:43:07Z",
"modified": "2024-11-22T20:20:57Z",
"published": "2023-12-05T23:43:07Z",
"aliases": [
"CVE-2023-49297"
@@ -61,6 +61,10 @@
"type": "PACKAGE",
"url": "https://github.com/iterative/PyDrive2"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pydrive2/PYSEC-2023-291.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYR5SJKOFSSXFV3E3D2SLXBUBA5WMJJG"
advisories/unreviewed/2022/04/GHSA-h2rr-m97p-6jq9/GHSA-h2rr-m97p-6jq9.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h2rr-m97p-6jq9",
"modified": "2022-04-28T00:00:48Z",
"published": "2022-04-20T00:00:34Z",
"aliases": [
"CVE-2022-28108"
],
"details": "Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28108"
},
{
"type": "WEB",
"url": "https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2022/02/07/3"
},
{
"type": "WEB",
"url": "https://www.selenium.dev/downloads"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-19T03:15:00Z"
}
}