netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-69j6-29vr-p3j9
GHSA-v92f-jx6p-73rx
This commit is contained in:
advisory-database[bot]
2025-02-18 22:41:09 +00:00
parent fde4588646
commit 53436a8626
2 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2021/10/GHSA-69j6-29vr-p3j9/GHSA-69j6-29vr-p3j9.json
+11 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-69j6-29vr-p3j9",
"modified": "2021-11-18T15:13:27Z",
"modified": "2025-02-18T22:39:14Z",
"published": "2021-10-05T20:24:02Z",
"aliases": [
"CVE-2021-39226"
@@ -79,6 +79,14 @@
"type": "WEB",
"url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6ANHRDBXQT6TURLP2THM26ZPDINFBEG"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DCKBFUSY6V4VU5AQUYWKISREZX5NLQJT"
@@ -98,7 +106,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-287"
"CWE-287",
"CWE-862"
],
"severity": "HIGH",
"github_reviewed": true,
advisories/github-reviewed/2023/09/GHSA-v92f-jx6p-73rx/GHSA-v92f-jx6p-73rx.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v92f-jx6p-73rx",
"modified": "2023-09-19T20:35:16Z",
"modified": "2025-02-18T22:39:30Z",
"published": "2023-09-19T20:35:16Z",
"aliases": [
"CVE-2022-24816"
],
"summary": "Improper Control of Generation of Code ('Code Injection') in jai-ext",
"details": "### Impact\nPrograms using jt-jiffle, and allowing Jiffle script to be provided via network request, are susceptible to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project.\n\n### Patches\nVersion 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script.\n\n### Workarounds\nNegate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.\n\n### References\nNone.\n\n",
"details": "### Impact\nPrograms using jt-jiffle, and allowing Jiffle script to be provided via network request, are susceptible to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project.\n\n### Patches\nVersion 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script.\n\n### Workarounds\nNegate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.\n\n### References\nNone.",
"severity": [
{
"type": "CVSS_V3",