mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-3gx6-h57h-rm27 GHSA-h377-287m-w2r9 GHSA-q3p9-8728-wq7x GHSA-qqxc-cppg-4xp8 GHSA-w7qx-vwr9-2j3r GHSA-3gx6-h57h-rm27 GHSA-h377-287m-w2r9 GHSA-q3p9-8728-wq7x GHSA-qqxc-cppg-4xp8 GHSA-w7qx-vwr9-2j3r
This commit is contained in:
advisory-database[bot]
@@ -0,0 +1,184 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3gx6-h57h-rm27",
|
||||
"modified": "2024-04-23T17:19:43Z",
|
||||
"published": "2022-05-13T01:22:41Z",
|
||||
"aliases": [
|
||||
"CVE-2019-6340"
|
||||
],
|
||||
"summary": "Drupal Core Remote Code Execution Vulnerability",
|
||||
"details": "Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/core"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "8.6.0"
|
||||
},
|
||||
{
|
||||
"fixed": "8.6.10"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/core"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "7.0.0"
|
||||
},
|
||||
{
|
||||
"fixed": "7.62.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/core"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "8.0.0"
|
||||
},
|
||||
{
|
||||
"fixed": "8.5.11"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/drupal"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "7.0.0"
|
||||
},
|
||||
{
|
||||
"fixed": "7.62.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/drupal"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "8.0.0"
|
||||
},
|
||||
{
|
||||
"fixed": "8.5.11"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/drupal"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "8.6.0"
|
||||
},
|
||||
{
|
||||
"fixed": "8.6.10"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6340"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6340.yaml"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6340.yaml"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/drupal/drupal"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.drupal.org/sa-core-2019-003"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.exploit-db.com/exploits/46452"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.exploit-db.com/exploits/46459"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.exploit-db.com/exploits/46510"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.synology.com/security/advisory/Synology_SA_19_09"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.securityfocus.com/bid/107106"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-502"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-23T17:19:43Z",
|
||||
"nvd_published_at": "2019-02-21T21:29:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,100 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-h377-287m-w2r9",
|
||||
"modified": "2024-04-23T17:20:19Z",
|
||||
"published": "2022-05-13T01:36:23Z",
|
||||
"aliases": [
|
||||
"CVE-2017-6921"
|
||||
],
|
||||
"summary": "Drupal file REST resource does not properly validate",
|
||||
"details": "In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/core"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "8.0"
|
||||
},
|
||||
{
|
||||
"fixed": "8.3.4"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/drupal"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "8.0"
|
||||
},
|
||||
{
|
||||
"fixed": "8.3.4"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6921"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6921.yaml"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6921.yaml"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/drupal/core"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.drupal.org/SA-CORE-2017-003"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.securityfocus.com/bid/99222"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.securitytracker.com/id/1038781"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-20"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-23T17:20:19Z",
|
||||
"nvd_published_at": "2019-01-15T21:29:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,138 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-q3p9-8728-wq7x",
|
||||
"modified": "2024-04-23T17:19:46Z",
|
||||
"published": "2022-05-17T03:57:19Z",
|
||||
"aliases": [
|
||||
"CVE-2016-3169"
|
||||
],
|
||||
"summary": "Drupal saving user accounts can sometimes grant the user all roles",
|
||||
"details": "The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/core"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "6.0"
|
||||
},
|
||||
{
|
||||
"fixed": "6.38"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/core"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "7.0"
|
||||
},
|
||||
{
|
||||
"fixed": "7.43"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/drupal"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "7.0"
|
||||
},
|
||||
{
|
||||
"fixed": "7.43"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/drupal"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "6.0"
|
||||
},
|
||||
{
|
||||
"fixed": "6.38"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3169"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3169.yaml"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3169.yaml"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/drupal/core"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.drupal.org/SA-CORE-2016-001"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.debian.org/security/2016/dsa-3498"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2016/02/24/19"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2016/03/15/10"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-269"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-23T17:19:46Z",
|
||||
"nvd_published_at": "2016-04-12T15:59:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,138 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-qqxc-cppg-4xp8",
|
||||
"modified": "2024-04-23T17:19:29Z",
|
||||
"published": "2022-05-17T03:57:06Z",
|
||||
"aliases": [
|
||||
"CVE-2016-3168"
|
||||
],
|
||||
"summary": "Drupal Reflected file download vulnerability",
|
||||
"details": "The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a \"reflected file download vulnerability.\"",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/core"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "6.0"
|
||||
},
|
||||
{
|
||||
"fixed": "6.38"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/core"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "7.0"
|
||||
},
|
||||
{
|
||||
"fixed": "7.43"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/drupal"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "7.0"
|
||||
},
|
||||
{
|
||||
"fixed": "7.43"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/drupal"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "6.0"
|
||||
},
|
||||
{
|
||||
"fixed": "6.38"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3168"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3168.yaml"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3168.yaml"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/drupal/core"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.drupal.org/SA-CORE-2016-001"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.debian.org/security/2016/dsa-3498"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2016/02/24/19"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2016/03/15/10"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-23T17:19:29Z",
|
||||
"nvd_published_at": "2016-04-12T15:59:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,92 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-w7qx-vwr9-2j3r",
|
||||
"modified": "2024-04-23T17:20:43Z",
|
||||
"published": "2022-05-13T01:46:32Z",
|
||||
"aliases": [
|
||||
"CVE-2017-6377"
|
||||
],
|
||||
"summary": "Drupal editor module incorrectly checks access to inline private files",
|
||||
"details": "When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/core"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "8.2.0"
|
||||
},
|
||||
{
|
||||
"fixed": "8.2.7"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "drupal/drupal"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "8.2.0"
|
||||
},
|
||||
{
|
||||
"fixed": "8.2.7"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6377"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6377.yaml"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6377.yaml"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.drupal.org/SA-2017-001"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.securityfocus.com/bid/96919"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.securitytracker.com/id/1038058"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-863"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-23T17:20:42Z",
|
||||
"nvd_published_at": "2017-03-16T14:59:00Z"
|
||||
}
|
||||
}
|
||||
@@ -1,58 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3gx6-h57h-rm27",
|
||||
"modified": "2022-05-13T01:22:41Z",
|
||||
"published": "2022-05-13T01:22:41Z",
|
||||
"aliases": [
|
||||
"CVE-2019-6340"
|
||||
],
|
||||
"details": "Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6340"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.drupal.org/sa-core-2019-003"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.exploit-db.com/exploits/46452"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.exploit-db.com/exploits/46459"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.exploit-db.com/exploits/46510"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.synology.com/security/advisory/Synology_SA_19_09"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.securityfocus.com/bid/107106"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-502"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2019-02-21T21:29:00Z"
|
||||
}
|
||||
}
|
||||
@@ -1,46 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-h377-287m-w2r9",
|
||||
"modified": "2022-05-13T01:36:23Z",
|
||||
"published": "2022-05-13T01:36:23Z",
|
||||
"aliases": [
|
||||
"CVE-2017-6921"
|
||||
],
|
||||
"details": "In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6921"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.securityfocus.com/bid/99222"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.securitytracker.com/id/1038781"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-20"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2019-01-15T21:29:00Z"
|
||||
}
|
||||
}
|
||||
@@ -1,50 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-q3p9-8728-wq7x",
|
||||
"modified": "2022-05-17T03:57:19Z",
|
||||
"published": "2022-05-17T03:57:19Z",
|
||||
"aliases": [
|
||||
"CVE-2016-3169"
|
||||
],
|
||||
"details": "The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3169"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.drupal.org/SA-CORE-2016-001"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.debian.org/security/2016/dsa-3498"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2016/02/24/19"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2016/03/15/10"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2016-04-12T15:59:00Z"
|
||||
}
|
||||
}
|
||||
@@ -1,50 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-qqxc-cppg-4xp8",
|
||||
"modified": "2022-05-17T03:57:06Z",
|
||||
"published": "2022-05-17T03:57:06Z",
|
||||
"aliases": [
|
||||
"CVE-2016-3168"
|
||||
],
|
||||
"details": "The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a \"reflected file download vulnerability.\"",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3168"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.drupal.org/SA-CORE-2016-001"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.debian.org/security/2016/dsa-3498"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2016/02/24/19"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2016/03/15/10"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2016-04-12T15:59:00Z"
|
||||
}
|
||||
}
|
||||
@@ -1,46 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-w7qx-vwr9-2j3r",
|
||||
"modified": "2022-05-13T01:46:32Z",
|
||||
"published": "2022-05-13T01:46:32Z",
|
||||
"aliases": [
|
||||
"CVE-2017-6377"
|
||||
],
|
||||
"details": "When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6377"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.drupal.org/SA-2017-001"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.securityfocus.com/bid/96919"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.securitytracker.com/id/1038058"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-863"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2017-03-16T14:59:00Z"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user