Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-11-28 05:05:23 +00:00
parent e297aec3e0
commit 511648c69a
920 changed files with 1700 additions and 5088 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "sprockets vulnerable to Path Traversal",
  "details": "Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -89,9 +89,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:23:16Z",
@@ -69,9 +69,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2019-11-12T22:13:08Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Plone Improper Session Management",
  "details": "Plone CMS before 3, places a base64 encoded form of the username and password in the `__ac` cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -67,9 +65,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-14T17:20:01Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Cobbler is vulnerable to code injection ",
  "details": "template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Plone CMS Improper Session Management",
  "details": "Plone CMS before 3 places a base64 encoded form of the username and password in the `__ac` cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -63,9 +61,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-14T17:20:03Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-xfqg-p48g-hh94",
  "modified": "2022-06-02T21:02:00Z",
  "published": "2022-06-02T21:02:00Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Login timing attack in ezsystems/ezpublish-kernel",
  "details": "Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replaces this with constant time functionality, configured in the new security.yml parameter 'ibexa.security.authentication.constant_auth_time'. It will log a warning if the constant time is exceeded. If this happens the setting should be increased.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-m58q-qq5h-mgqq",
  "modified": "2022-07-21T22:36:20Z",
  "published": "2022-07-21T22:36:20Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository",
  "details": "### Impact\nThis vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater.\n\n### Patches\nUpgrade immediately to the [latest release](https://github.com/Islandora/islandora/releases/tag/2.4.1) of Islandora.\n\n### Workarounds\nIn lieu of an upgrade the [following module](https://github.com/Islandora/islandora_ghsa_route_fix) can be leveraged that will resolve the issue until such a time an upgrade can take place.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Islandora](https://github.com/Islandora/islandora)\n* Contact community@islandora.ca.\n",
  "severity": [
@@ -54,9 +52,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-21T22:36:20Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-26hr-q2wp-rvc5",
  "modified": "2023-12-12T00:58:04Z",
  "published": "2023-12-12T00:58:04Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "User with permission to write actions can impersonate another user when auth token is configured in environment variable",
  "details": "### Impact\n\nWhen lakeFS is configured with **ALL** of the following:\n\n- Configuration option `auth.encrypt.secret_key` passed through environment variable\n- Actions enabled via configuration option `actions.enabled` (default enabled)\n\nthen a user who can configure an action can impersonate any other user.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n### Workarounds\n\n**ANY ONE** of these is sufficient to prevent the issue:\n\n* Do not pass `auth.encrypt.secret_key` through an environment variable.\n\n   For instance, Kubernetes users can generate the entire configuration as a secret and mount that.  This is described [here](https://kubernetes.io/docs/concepts/configuration/secret/#using-a-secret).\n* Disable actions.\n* Limit users allowed to configure actions.\n\n",
  "severity": [
@@ -46,9 +44,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-12T00:58:04Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-w4x6-hh3x-wjrx",
  "modified": "2023-12-11T21:47:14Z",
  "published": "2023-12-11T21:47:14Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Stale copy of the public suffix list",
  "details": "We have identified that this project contains an out-of-date version of the Public Suffix List (https://publicsuffix.org/). We are carrying out research to identify the potential impacts of using old versions of the Public Suffix List, and we intend to publish our results in academic conferences and journals. Our results will become publicly available after 21 days; this provides time to update your project with an up-to-date version of the Public Suffix List.\n\nGitHub repository: gsemac/Gsemac.Common\nPublic Suffix List path: src/Gsemac.Net/Resources/public_suffix_list.dat\n\nThe Public Suffix List is regularly updated (generally a few times per week), and to ensure that the correct privacy boundaries are maintained between websites, applications that use it should routinely fetch an updated copy. If new suffixes are added to the list, and an old list is then used, privacy boundaries will not be constructed correctly, allowing for data (e.g., cookies) to be set incorrectly, potentially harming privacy.\n\nThere is further guidance on how the Public Suffix List should be used in ICANN’s “Advisory on the Use of Static TLD / Suffix Lists” at https://www.icann.org/en/system/files/files/sac-070-en.pdf.\n\nIf you have any questions about our research, or about usage of the Public Suffix List, please reply via e-mail to [sm@smcquistin.uk](mailto:sm@smcquistin.uk).",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -47,9 +43,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-11T21:47:14Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Ollama does not validate the format of the digest (sha256 with 64 hex digits)",
  "details": "Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial `../` substring.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -71,9 +69,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-02T22:32:29Z",
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3wfj-3x8q-hrpg",
-  "modified": "2024-09-06T21:38:20Z",
+  "modified": "2024-11-18T16:27:00Z",
  "published": "2024-08-05T16:07:50Z",
  "aliases": [
    "CVE-2024-41820"
@@ -70,7 +70,7 @@
      "CWE-276",
      "CWE-732"
    ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-05T16:07:50Z",
    "nvd_published_at": "2024-08-05T20:15:35Z"
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
--- a/Show More
+++ b/Show More