netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-12-04 05:24:13 +00:00
parent 3a18bd01c8
commit 4fb935298f
917 changed files with 1998 additions and 5994 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/01/GHSA-7v3x-h7r2-34jv/GHSA-7v3x-h7r2-34jv.json
+1 -3
View File
@@ -3,9 +3,7 @@
"id": "GHSA-7v3x-h7r2-34jv",
"modified": "2022-01-20T16:18:28Z",
"published": "2022-01-21T18:43:05Z",
"aliases": [
],
"aliases": [],
"summary": "Insufficient Session Expiration in Pterodactyl API",
"details": "### Impact\nA vulnerability exists in Pterodactyl Panel `<= 1.6.6` that could allow a malicious attacker that compromises an API key to generate an authenticated user session that is not revoked when the API key is deleted, thus allowing the malicious user to remain logged in as the user the key belonged to.\n\nIt is important to note that **a malicious user must first compromise an existing API key for a user to exploit this issue**. It cannot be exploited by chance, and requires a coordinated attack against an individual account using a known API key.\n\n### Patches\nThis issue has been addressed in the `v1.7.0` release of Pterodactyl Panel.\n\n### Workarounds\nThose not wishing to upgrade may apply the change below:\n\n```diff\ndiff --git a/app/Http/Middleware/Api/AuthenticateKey.php b/app/Http/Middleware/Api/AuthenticateKey.php\nindex eb25dac6..857bfab2 100644\n--- a/app/Http/Middleware/Api/AuthenticateKey.php\n+++ b/app/Http/Middleware/Api/AuthenticateKey.php\n@@ -70,7 +70,7 @@ class AuthenticateKey\n } else {\n $model = $this->authenticateApiKey($request->bearerToken(), $keyType);\n\n- $this->auth->guard()->loginUsingId($model->user_id);\n+ $this->auth->guard()->onceUsingId($model->user_id);\n }\n```\n\n### For more information\nIf you have any questions or comments about this advisory please reach out to `Tactical Fish#8008` on [Discord](https://discord.gg/pterodactyl) or email `dane@pterodactyl.io`.\n",
"severity": [
advisories/github-reviewed/2022/01/GHSA-rcrv-228c-gprj/GHSA-rcrv-228c-gprj.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-rcrv-228c-gprj",
"modified": "2022-01-20T18:36:49Z",
"published": "2022-01-21T18:39:40Z",
"aliases": [
],
"aliases": [],
"summary": "Invalid URL generation in bitlyshortener",
"details": "### Impact\nDue to a sudden upstream breaking change by Bitly, versions of `bitlyshortener` <0.6.0 generate invalid short URLs. All users are affected and must update immediately.\n\n### Patches\nUpgrading `bitlyshortener` to 0.6.0 or newer will prevent the generation such invalid short URLs.\n\n### Workarounds\nA workaround is to replace \"https://j.mp/\" in each generated short URL with \"https://bit.ly/\".\n\n### References\n* [Release notes](https://github.com/impredicative/bitlyshortener/releases)",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -51,9 +47,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2022-01-20T18:36:49Z",
advisories/unreviewed/2022/01/GHSA-226r-cf9r-2r9j/GHSA-226r-cf9r-2r9j.json
+3 -9
View File
@@ -7,12 +7,8 @@
"CVE-2022-21390"
],
"details": "Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Webservices Manager). Supported versions that are affected are 12.0.0.3 and 12.0.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. While the vulnerability is in Oracle Communications Billing and Revenue Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -24,9 +20,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-228r-jxv7-v353/GHSA-228r-jxv7-v353.json
+3 -9
View File
@@ -7,12 +7,8 @@
"CVE-2022-21278"
],
"details": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -28,9 +24,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-28gq-hp3j-rpwx/GHSA-28gq-hp3j-rpwx.json
+3 -9
View File
@@ -7,12 +7,8 @@
"CVE-2022-21331"
],
"details": "Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L).",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -32,9 +28,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-2j47-26hx-p54j/GHSA-2j47-26hx-p54j.json
+3 -9
View File
@@ -7,12 +7,8 @@
"CVE-2022-21338"
],
"details": "Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: General Framework). The supported version that is affected is 3.0.2.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Convergence. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Convergence accessible data as well as unauthorized read access to a subset of Oracle Communications Convergence accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -24,9 +20,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-2v88-56v7-rphj/GHSA-2v88-56v7-rphj.json
+3 -9
View File
@@ -7,12 +7,8 @@
"CVE-2022-21285"
],
"details": "Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -32,9 +28,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-2vgx-9h8g-j98m/GHSA-2vgx-9h8g-j98m.json
+3 -9
View File
@@ -7,12 +7,8 @@
"CVE-2022-21357"
],
"details": "Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L).",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -32,9 +28,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-3625-3v8q-96pc/GHSA-3625-3v8q-96pc.json
+2 -6
View File
@@ -13,9 +13,7 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -39,9 +37,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-3c62-2g9v-gfg6/GHSA-3c62-2g9v-gfg6.json
+3 -9
View File
@@ -7,12 +7,8 @@
"CVE-2022-21397"
],
"details": "Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Operations Monitor. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Operations Monitor, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Operations Monitor accessible data as well as unauthorized read access to a subset of Oracle Communications Operations Monitor accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -24,9 +20,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-3cq6-4846-47jh/GHSA-3cq6-4846-47jh.json
+3 -9
View File
@@ -7,12 +7,8 @@
"CVE-2022-21321"
],
"details": "Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L).",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -32,9 +28,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-3gg4-6p9p-6fgc/GHSA-3gg4-6p9p-6fgc.json
+2 -6
View File
@@ -13,9 +13,7 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -39,9 +37,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-3gxf-gcm8-jmp8/GHSA-3gxf-gcm8-jmp8.json
+3 -9
View File
@@ -7,12 +7,8 @@
"CVE-2022-21289"
],
"details": "Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -32,9 +28,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-3m36-cwxf-r2rc/GHSA-3m36-cwxf-r2rc.json
+3 -9
View File
@@ -7,12 +7,8 @@
"CVE-2022-21312"
],
"details": "Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L).",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -32,9 +28,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-3p64-r56c-8fcp/GHSA-3p64-r56c-8fcp.json
+3 -9
View File
@@ -7,12 +7,8 @@
"CVE-2022-21346"
],
"details": "Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -28,9 +24,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-3rfh-9f52-4ppx/GHSA-3rfh-9f52-4ppx.json
+2 -6
View File
@@ -7,12 +7,8 @@
"CVE-2022-0243"
],
"details": "Cross-site Scripting (XSS) - Stored in GitHub repository orchardcms/orchardcore prior to 1.2.2.",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
advisories/unreviewed/2022/01/GHSA-42ch-5f46-47c6/GHSA-42ch-5f46-47c6.json
+3 -9
View File
@@ -7,12 +7,8 @@
"CVE-2022-21311"
],
"details": "Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L).",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -32,9 +28,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-42rq-7wx4-5vff/GHSA-42rq-7wx4-5vff.json
+3 -9
View File
@@ -7,12 +7,8 @@
"CVE-2022-21352"
],
"details": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H).",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -28,9 +24,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-42v8-4h63-pf87/GHSA-42v8-4h63-pf87.json
+2 -6
View File
@@ -13,9 +13,7 @@
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -39,9 +37,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2022/01/GHSA-43m7-cr4f-cpcc/GHSA-43m7-cr4f-cpcc.json
+3 -9
View File
@@ -7,12 +7,8 @@
"CVE-2022-21300"
],
"details": "Vulnerability in the PeopleSoft Enterprise CS SA Integration Pack product of Oracle PeopleSoft (component: Snapshot Integration). Supported versions that are affected are 9.0 and 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS SA Integration Pack. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS SA Integration Pack accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",
"severity": [
],
"affected": [
],
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -24,9 +20,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,

Some files were not shown because too many files have changed in this diff Show More