netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2vhr-4mhq-m35c
GHSA-5cw4-ggx9-36vg
GHSA-f9m9-494r-w36p
GHSA-2vhr-4mhq-m35c
GHSA-f9m9-494r-w36p
This commit is contained in:
advisory-database[bot]
2024-01-23 17:53:45 +00:00
parent a33d2226e0
commit 5149d4ebb2
5 changed files with 303 additions and 131 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json
+120
View File
@@ -0,0 +1,120 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2vhr-4mhq-m35c",
"modified": "2024-01-23T17:51:55Z",
"published": "2022-05-13T01:12:50Z",
"aliases": [
"CVE-2014-0123"
],
"summary": "Moodle does not properly restrict access",
"details": "The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0123"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/3a7b9b76c2d3c58237bec56b3b537e05c23970ad"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/d9596365e59ac53787105ff326f7f2bab5b9bada"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/e6499fb8a4463b1130babb09c42f3d5559276d17"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/fa0777902633b54ca5566dd8af304ce5587051e5"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=256419"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39990"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/03/17/1"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-23T17:51:55Z",
"nvd_published_at": "2014-03-24T14:20:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json → advisories/github-reviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json
+63 -45
View File
@@ -1,17 +1,74 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5cw4-ggx9-36vg",
"modified": "2022-05-02T03:12:29Z",
"modified": "2024-01-23T17:52:36Z",
"published": "2022-05-02T03:12:29Z",
"aliases": [
"CVE-2009-0033"
],
"summary": "Apache Tomcat Denial of Service via Malformed Request Headers",
"details": "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.1.0"
},
{
"last_affected": "4.1.39"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"last_affected": "5.5.27"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.0.0"
},
{
"last_affected": "6.0.18"
}
]
}
]
}
],
"references": [
{
@@ -130,30 +187,6 @@
"type": "WEB",
"url": "http://marc.info/?l=bugtraq&m=136485229118404&w=2"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35326"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35344"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35685"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35788"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/37460"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42368"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1022331"
@@ -217,31 +250,16 @@
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1496"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1856"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/3316"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/3056"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-400"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-23T17:52:36Z",
"nvd_published_at": "2009-06-05T16:00:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json
+120
View File
@@ -0,0 +1,120 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f9m9-494r-w36p",
"modified": "2024-01-23T17:51:44Z",
"published": "2022-05-13T01:12:50Z",
"aliases": [
"CVE-2014-0122"
],
"summary": "Moodle allows bypass of intended access restrictions",
"details": "mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0122"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/3d7810ab3d67a423a760ba89ae75de81d940b236"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/4d4867503c2467cb04660d9cb314d22f56004054"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/5c45ea0c6bf2fdf4dddfaef9fc5ff12e6b426a3f"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/7748e17207b1a28118d9dc622878da22f956d3fe"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=256418"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44082"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/03/17/1"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-23T17:51:44Z",
"nvd_published_at": "2014-03-24T14:20:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-2vhr-4mhq-m35c/GHSA-2vhr-4mhq-m35c.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2vhr-4mhq-m35c",
"modified": "2022-05-13T01:12:50Z",
"published": "2022-05-13T01:12:50Z",
"aliases": [
"CVE-2014-0123"
],
"details": "The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0123"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=256419"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39990"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/03/17/1"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-03-24T14:20:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-f9m9-494r-w36p/GHSA-f9m9-494r-w36p.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f9m9-494r-w36p",
"modified": "2022-05-13T01:12:50Z",
"published": "2022-05-13T01:12:50Z",
"aliases": [
"CVE-2014-0122"
],
"details": "mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0122"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=256418"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44082"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/03/17/1"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-03-24T14:20:00Z"
}
}