netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-9f3p-wvj7-q82x
GHSA-whx6-m9j4-w2m2
GHSA-x9r9-48rm-4xm6
GHSA-mv5w-wr5c-575p
GHSA-whx6-m9j4-w2m2
This commit is contained in:
advisory-database[bot]
2024-08-29 18:05:03 +00:00
parent 019192088d
commit 522427ccd1
5 changed files with 167 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-9f3p-wvj7-q82x/GHSA-9f3p-wvj7-q82x.json → advisories/github-reviewed/2022/05/GHSA-9f3p-wvj7-q82x/GHSA-9f3p-wvj7-q82x.json
+23 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9f3p-wvj7-q82x",
"modified": "2024-04-04T02:06:30Z",
"modified": "2024-08-29T18:03:14Z",
"published": "2022-05-24T16:57:30Z",
"aliases": [
"CVE-2019-16760"
],
"summary": "Cargo prior to Rust 1.26.0 may download the wrong dependency",
"details": "Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency, which could be squatted on crates.io to be a malicious package. This not only affects manifests that you write locally yourself, but also manifests published to crates.io. Rust 1.0.0 through Rust 1.25.0 is affected by this advisory because Cargo will ignore the `package` key in manifests. Rust 1.26.0 through Rust 1.30.0 are not affected and typically will emit an error because the `package` key is unstable. Rust 1.31.0 and after are not affected because Cargo understands the `package` key. Users of the affected versions are strongly encouraged to update their compiler to the latest available one. Preventing this issue from happening requires updating your compiler to be either Rust 1.26.0 or newer. There will be no point release for Rust versions prior to 1.26.0. Users of Rust 1.19.0 to Rust 1.25.0 can instead apply linked patches to mitigate the issue.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "cargo"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.27.0"
}
]
}
]
}
],
"references": [
{
@@ -47,8 +66,8 @@
"CWE-494"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-08-29T18:03:14Z",
"nvd_published_at": "2019-09-30T22:15:00Z"
}
}
advisories/github-reviewed/2024/02/GHSA-whx6-m9j4-w2m2/GHSA-whx6-m9j4-w2m2.json
+81
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2024/03/GHSA-x9r9-48rm-4xm6/GHSA-x9r9-48rm-4xm6.json → advisories/github-reviewed/2024/03/GHSA-x9r9-48rm-4xm6/GHSA-x9r9-48rm-4xm6.json
+28 -5
View File
@@ -1,20 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x9r9-48rm-4xm6",
"modified": "2024-08-28T18:31:53Z",
"modified": "2024-08-29T18:02:50Z",
"published": "2024-03-18T09:30:30Z",
"aliases": [
"CVE-2024-28125"
],
"summary": "FitNesse allows execution of arbitrary OS commands",
"details": "FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.fitnesse:fitnesse"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "20240707"
}
]
}
]
}
],
"references": [
{
@@ -22,7 +45,7 @@
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28125"
},
{
"type": "WEB",
"type": "PACKAGE",
"url": "https://github.com/unclebob/fitnesse"
},
{
@@ -43,8 +66,8 @@
"CWE-77"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-08-29T18:02:50Z",
"nvd_published_at": "2024-03-18T08:15:06Z"
}
}
advisories/unreviewed/2024/04/GHSA-mv5w-wr5c-575p/GHSA-mv5w-wr5c-575p.json → advisories/github-reviewed/2024/04/GHSA-mv5w-wr5c-575p/GHSA-mv5w-wr5c-575p.json
+35 -9
View File
@@ -1,26 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mv5w-wr5c-575p",
"modified": "2024-08-28T21:31:27Z",
"modified": "2024-08-29T18:03:35Z",
"published": "2024-04-10T21:30:34Z",
"aliases": [
"CVE-2024-31819"
],
"summary": "WWBN AVideo Remote Code Execution",
"details": "An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "wwbn/avideo"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "12.4"
},
{
"fixed": "14.3"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 14.2"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31819"
},
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/commit/fcb1f79278684f02ee59130dc0304bd063d9d6d7"
},
{
"type": "WEB",
"url": "https://chocapikk.com/posts/2024/cve-2024-31819"
@@ -30,11 +60,7 @@
"url": "https://github.com/Chocapikk/CVE-2024-31819"
},
{
"type": "WEB",
"url": "https://github.com/WWBN"
},
{
"type": "WEB",
"type": "PACKAGE",
"url": "https://github.com/WWBN/AVideo"
}
],
@@ -43,8 +69,8 @@
"CWE-94"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-08-29T18:03:35Z",
"nvd_published_at": "2024-04-10T20:15:08Z"
}
}
advisories/unreviewed/2024/02/GHSA-whx6-m9j4-w2m2/GHSA-whx6-m9j4-w2m2.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-whx6-m9j4-w2m2",
"modified": "2024-08-29T00:31:34Z",
"published": "2024-02-29T03:33:18Z",
"aliases": [
"CVE-2024-25713"
],
"details": "yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks. (pool_free is part of the pool series allocator, along with pool_malloc and pool_realloc.)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"
}
],
"affected": [
],
"references": [
{
"type": "WEB",
"url": "https://github.com/ibireme/yyjson/security/advisories/GHSA-q4m7-9pcm-fpxh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25713"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KQ67T4R7QEWURW5NMCCVLTBASL4ECHE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NNICQVIF7BRYFWYRL3HPVAJIPXN4OVTX"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TKQPEREDUDKGYJMFNFDQVYCVLWDRO2Y2"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T01:44:16Z"
}
}